Typosquatted npm Package postcss-minify-selector-parser Delivers Nuitka-Compiled Windows RAT with RC4-Encrypted HTTP C2

Typosquatted npm Package postcss-minify-selector-parser (TL-2026-0910), also tracked as From PostCSS Typosquat to Windows RAT, is a critical-severity supply-chain compromise, first published 2026-06-23. It has no confirmed attribution, affects npm (OpenJS / GitHub) npm registry packages, maps to 22 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 9 detection rules and 28 indicators of compromise.

Key facts for TL-2026-0910

Threat ID
TL-2026-0910
Also known as
From PostCSS Typosquat to Windows RAT, postcss-minify-selector-parser RAT, csshost RAT
Severity
CRITICAL
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-06-23
Last reviewed
2026-06-23
Attribution confidence
NONE
Motivation
FINANCIAL
Target sectors
technology, software development, open source ecosystem, devops
Target regions
Global
Detection rules
9
Indicators of compromise
28

Malware and tooling in Typosquatted npm Package postcss-minify-selector-parser

Malware and tooling: Nuitka, PowerShell, VBScript

JFrog Security Research disclosed a malicious npm package, postcss-minify-selector-parser, that typosquats the legitimate postcss-selector-parser (150M+ weekly downloads) to deliver a full-featured Windows RAT. A multi-stage chain (AES-256-GCM JavaScript dropper to PowerShell downloader to VBS bootstrapper to a Nuitka-compiled Python implant) establishes RC4/ARC4-encrypted HTTP C2 to 95.216.92.207:8080, steals Chrome credentials including app-bound-encrypted secrets, detects virtual machines, and persists via an HKCU Run key named csshost.

How Typosquatted npm Package postcss-minify-selector-parser works

On 22 June 2026, JFrog Security Research (Yair Benamou) published 'From PostCSS Typosquat to Windows RAT', detailing an active npm supply-chain campaign. The npm account abdrizak published three malicious packages: postcss-minify-selector-parser (XRAY-1002983, the primary lure), postcss-minify-selector (XRAY-1003986), and aes-decode-runner-pro (XRAY-989675). The primary package mimics the trusted postcss-selector-parser by reusing the postcss/selector/parser/css keyword space and even declaring the genuine package as a dependency so it appears credible during a quick dependency review.

The infection chain is multi-stage. An encoded blob hidden in src/config/defaults.js (loaded via the index.js entry point) decodes through an internal chain that includes AES-256-GCM, yielding a JavaScript dropper. That dropper writes a PowerShell script to ../../settings.ps1 and executes it with a bypassed execution policy. The PowerShell stage acts as a downloader, retrieving a Windows bundle from the lookalike domain nvidiadriver[.]net (URL hxxp://nvidiadriver[.]net/verv1432/winpatch-xd7d[.]win), saving it as %TEMP%\winPatch.zip and extracting it into %TEMP%\winPatch. A VBS bootstrapper, update.vbs, then expands an inner dll.zip with tar and launches the implant via a renamed Python launcher: chost.exe loader.py (bundled with python310.dll).

The final implant is a Python application compiled with Nuitka into native .pyd extension modules, making static inspection substantially harder than a typical script threat. Functionality is split across modules: audiodriver (main RAT orchestration), api (HTTP C2 packet exchange), command (host actions and shell execution), config (RAT configuration), auto (Chrome credential theft) and util (archive helper). The RAT enforces single-instance execution, stores a persistent victim UUID (%TEMP%.store) and host configuration (%TEMP%.host), and persists across reboots via the registry Run key HKCU\Software\Microsoft\Windows\CurrentVersion\Run with the value name csshost.

C2 is HTTP-based to 95.216.92.207:8080. All traffic is wrapped with RC4/ARC4 stream encryption and carries MD5 checksums embedded inside the encrypted POST packets for integrity, defeating naive network-content detection. The implant first sends a host profile (including VM checks) then loops awaiting commands, supporting remote shell execution, file upload/download tunneled through the C2 protocol, and randomized sleep for evasion. The auto module performs Chrome credential theft: it reads Chrome's Local State and Login Data SQLite database and decrypts stored secrets via Windows DPAPI, with additional AES-GCM and ChaCha20-Poly1305 handling so that even newer app-bound-encryption-protected credentials are recovered. It also collects Chrome extension data and stages output as chrome_logins_dump.txt inside an in-memory gather.tar.gz archive prior to exfiltration. Sandbox/VM evasion cross-references network adapter MAC address prefixes against known virtualization vendors (VMware, VirtualBox, QEMU) and uses WMI queries for environment profiling.

No CVE is assigned; this is a malicious-package supply-chain compromise rather than a product vulnerability. Named IOCs (the C2 IP, the delivery domain, three npm packages, and six .pyd SHA-256 hashes) are published, enabling immediate blocking and hunting. BeaconBeagle queries for the C2 IP 95.216.92.207 and the domain nvidiadriver[.]net returned no existing C2-framework correlation at time of research.

MITRE ATT&CK techniques used in TL-2026-0910

Collection

T1005 Data from Local System; T1560 Archive Collected Data

Discovery

T1016 System Network Configuration Discovery; T1082 System Information Discovery; T1497 Virtualization/Sandbox Evasion

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1573 Encrypted Channel

Initial Access

T1195 Supply Chain Compromise

Persistence

T1547 Boot or Logon Autostart Execution

Credential Access

T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Resource Development

T1583 Acquire Infrastructure; T1587 Develop Capabilities

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Typosquatted npm Package postcss-minify-selector-parser

  • npm (OpenJS / GitHub) — npm registry packages
    Vulnerable versions: postcss-minify-selector-parser (all published); postcss-minify-selector (all published); aes-decode-runner-pro (all published)
    Fixed in: packages removed / unpublished
  • Microsoft — Windows
    Vulnerable versions: Windows (developer workstations running the RAT)
  • Google — Chrome
    Vulnerable versions: Chrome (saved credentials, incl. app-bound encryption)

Remediation for Typosquatted npm Package postcss-minify-selector-parser

Immediate actions

  • Remove the malicious packages postcss-minify-selector-parser, postcss-minify-selector, and aes-decode-runner-pro from all projects and caches
  • Block the C2 indicator 95.216.92.207 (port 8080) and the domain nvidiadriver[.]net at the perimeter and DNS resolver
  • Hunt Windows hosts for %TEMP%\winPatch, %TEMP%.store, %TEMP%.host, settings.ps1, and chost.exe loader.py process activity
  • Check HKCU\Software\Microsoft\Windows\CurrentVersion\Run for a 'csshost' value and remove it
  • Rotate any credentials stored in Chrome on potentially affected developer workstations (assume compromise of saved passwords)

Workarounds

  • Disable automatic execution of npm lifecycle scripts in build/CI environments
  • Restrict developer workstation outbound access to known package registries and block direct downloads from arbitrary domains

Longer-term hardening

  • Inspect dependency trees for transitive pulls of the malicious packages and pin/lock dependencies
  • Adopt npm provenance, allow-lists, and pre-install script controls (npm install --ignore-scripts in CI) to blunt typosquat install-time execution
  • Deploy EDR with behavioral detection for PowerShell-spawned downloaders and VBS bootstrappers from npm/node processes
  • Enforce egress filtering and TLS/HTTP inspection to surface RC4-wrapped HTTP beacons to non-standard ports

Weaknesses (CWE) in Typosquatted npm Package postcss-minify-selector-parser

CWE-506, CWE-829, CWE-494, CWE-522

Timeline of Typosquatted npm Package postcss-minify-selector-parser

  • Cyber Security News, GBHackers, and CyberPress publish corroborating reporting of the campaign and IOCs.
  • Registry Run-key persistence under HKCU value 'csshost' and single-instance enforcement documented.
  • Chrome credential theft handling DPAPI, AES-GCM and ChaCha20-Poly1305 app-bound encryption, plus extension data exfiltration, attributed to the auto module.
  • RC4/ARC4-encrypted HTTP C2 to 95.216.92.207:8080 with MD5 checksums in encrypted POST packets documented.
  • Multi-stage chain documented: AES-256-GCM JavaScript dropper writes PowerShell to settings.ps1; PowerShell downloads winpatch-xd7d.win from nvidiadriver[.]net; update.vbs launches chost.exe loader.py.
  • Three malicious npm packages tied to account abdrizak identified: postcss-minify-selector-parser (XRAY-1002983), postcss-minify-selector (XRAY-1003986), aes-decode-runner-pro (XRAY-989675).
  • JFrog Security Research (Yair Benamou) publishes 'From PostCSS Typosquat to Windows RAT', disclosing the campaign and IOCs.
  • Threat ingested into Threadlinqs Intelligence; BeaconBeagle returned no prior C2 correlation for 95.216.92.207 or nvidiadriver[.]net.

Sources cited for Typosquatted npm Package postcss-minify-selector-parser

Threats related to Typosquatted npm Package postcss-minify-selector-parser

Detection coverage for TL-2026-0910

As of 2026-06-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0910 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats