Threat reportSupply ChainTL-2026-0910
Typosquatted npm Package postcss-minify-selector-parser Delivers Nuitka-Compiled Windows RAT with RC4-Encrypted HTTP C2
Typosquatted npm Package postcss-minify-selector-parser (TL-2026-0910), also tracked as From PostCSS Typosquat to Windows RAT, is a critical-severity supply-chain compromise, first published 2026-06-23. It has no confirmed attribution, affects npm (OpenJS / GitHub) npm registry packages, maps to 22 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 0None referenced
- Techniques
- 22MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-0910
- Threat ID
- TL-2026-0910
- Also known as
- From PostCSS Typosquat to Windows RAT, postcss-minify-selector-parser RAT, csshost RAT
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, open source ecosystem, devops
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in Typosquatted npm Package postcss-minify-selector-parser
Malware and tooling: Nuitka, PowerShell, VBScript
How Typosquatted npm Package postcss-minify-selector-parser works
JFrog Security Research disclosed a malicious npm package, postcss-minify-selector-parser, that typosquats the legitimate postcss-selector-parser (150M+ weekly downloads) to deliver a full-featured Windows RAT. A multi-stage chain (AES-256-GCM JavaScript dropper to PowerShell downloader to VBS bootstrapper to a Nuitka-compiled Python implant) establishes RC4/ARC4-encrypted HTTP C2 to 95.216.92.207:8080, steals Chrome credentials including app-bound-encrypted secrets, detects virtual machines, and persists via an HKCU Run key named csshost.
On 22 June 2026, JFrog Security Research (Yair Benamou) published 'From PostCSS Typosquat to Windows RAT', detailing an active npm supply-chain campaign. The npm account abdrizak published three malicious packages: postcss-minify-selector-parser (XRAY-1002983, the primary lure), postcss-minify-selector (XRAY-1003986), and aes-decode-runner-pro (XRAY-989675). The primary package mimics the trusted postcss-selector-parser by reusing the postcss/selector/parser/css keyword space and even declaring the genuine package as a dependency so it appears credible during a quick dependency review.
The infection chain is multi-stage. An encoded blob hidden in src/config/defaults.js (loaded via the index.js entry point) decodes through an internal chain that includes AES-256-GCM, yielding a JavaScript dropper. That dropper writes a PowerShell script to ../../settings.ps1 and executes it with a bypassed execution policy. The PowerShell stage acts as a downloader, retrieving a Windows bundle from the lookalike domain nvidiadriver[.]net (URL hxxp://nvidiadriver[.]net/verv1432/winpatch-xd7d[.]win), saving it as %TEMP%\winPatch.zip and extracting it into %TEMP%\winPatch. A VBS bootstrapper, update.vbs, then expands an inner dll.zip with tar and launches the implant via a renamed Python launcher: chost.exe loader.py (bundled with python310.dll).
The final implant is a Python application compiled with Nuitka into native .pyd extension modules, making static inspection substantially harder than a typical script threat. Functionality is split across modules: audiodriver (main RAT orchestration), api (HTTP C2 packet exchange), command (host actions and shell execution), config (RAT configuration), auto (Chrome credential theft) and util (archive helper). The RAT enforces single-instance execution, stores a persistent victim UUID (%TEMP%.store) and host configuration (%TEMP%.host), and persists across reboots via the registry Run key HKCU\Software\Microsoft\Windows\CurrentVersion\Run with the value name csshost.
C2 is HTTP-based to 95.216.92.207:8080. All traffic is wrapped with RC4/ARC4 stream encryption and carries MD5 checksums embedded inside the encrypted POST packets for integrity, defeating naive network-content detection. The implant first sends a host profile (including VM checks) then loops awaiting commands, supporting remote shell execution, file upload/download tunneled through the C2 protocol, and randomized sleep for evasion. The auto module performs Chrome credential theft: it reads Chrome's Local State and Login Data SQLite database and decrypts stored secrets via Windows DPAPI, with additional AES-GCM and ChaCha20-Poly1305 handling so that even newer app-bound-encryption-protected credentials are recovered. It also collects Chrome extension data and stages output as chrome_logins_dump.txt inside an in-memory gather.tar.gz archive prior to exfiltration. Sandbox/VM evasion cross-references network adapter MAC address prefixes against known virtualization vendors (VMware, VirtualBox, QEMU) and uses WMI queries for environment profiling.
No CVE is assigned; this is a malicious-package supply-chain compromise rather than a product vulnerability. Named IOCs (the C2 IP, the delivery domain, three npm packages, and six .pyd SHA-256 hashes) are published, enabling immediate blocking and hunting. BeaconBeagle queries for the C2 IP 95.216.92.207 and the domain nvidiadriver[.]net returned no existing C2-framework correlation at time of research.
MITRE ATT&CK techniques used in TL-2026-0910
Collection
T1005 Data from Local System; T1560 Archive Collected Data
Discovery
T1016 System Network Configuration Discovery; T1082 System Information Discovery; T1497 Virtualization/Sandbox Evasion
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1573 Encrypted Channel
Initial Access
Persistence
T1547 Boot or Logon Autostart Execution
Credential Access
T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Resource Development
T1583 Acquire Infrastructure; T1587 Develop Capabilities
defense-impairment
Affected products and versions in Typosquatted npm Package postcss-minify-selector-parser
- npm (OpenJS / GitHub) — npm registry packages
Vulnerable versions: postcss-minify-selector-parser (all published); postcss-minify-selector (all published); aes-decode-runner-pro (all published)
Fixed in: packages removed / unpublished - Microsoft — Windows
Vulnerable versions: Windows (developer workstations running the RAT) - Google — Chrome
Vulnerable versions: Chrome (saved credentials, incl. app-bound encryption)
Remediation for Typosquatted npm Package postcss-minify-selector-parser
Immediate actions
- Remove the malicious packages postcss-minify-selector-parser, postcss-minify-selector, and aes-decode-runner-pro from all projects and caches
- Block the C2 indicator 95.216.92.207 (port 8080) and the domain nvidiadriver[.]net at the perimeter and DNS resolver
- Hunt Windows hosts for %TEMP%\winPatch, %TEMP%.store, %TEMP%.host, settings.ps1, and chost.exe loader.py process activity
- Check HKCU\Software\Microsoft\Windows\CurrentVersion\Run for a 'csshost' value and remove it
- Rotate any credentials stored in Chrome on potentially affected developer workstations (assume compromise of saved passwords)
Workarounds
- Disable automatic execution of npm lifecycle scripts in build/CI environments
- Restrict developer workstation outbound access to known package registries and block direct downloads from arbitrary domains
Longer-term hardening
- Inspect dependency trees for transitive pulls of the malicious packages and pin/lock dependencies
- Adopt npm provenance, allow-lists, and pre-install script controls (npm install --ignore-scripts in CI) to blunt typosquat install-time execution
- Deploy EDR with behavioral detection for PowerShell-spawned downloaders and VBS bootstrappers from npm/node processes
- Enforce egress filtering and TLS/HTTP inspection to surface RC4-wrapped HTTP beacons to non-standard ports
Weaknesses (CWE) in Typosquatted npm Package postcss-minify-selector-parser
Timeline of Typosquatted npm Package postcss-minify-selector-parser
- Cyber Security News, GBHackers, and CyberPress publish corroborating reporting of the campaign and IOCs.
- Registry Run-key persistence under HKCU value 'csshost' and single-instance enforcement documented.
- Chrome credential theft handling DPAPI, AES-GCM and ChaCha20-Poly1305 app-bound encryption, plus extension data exfiltration, attributed to the auto module.
- RC4/ARC4-encrypted HTTP C2 to 95.216.92.207:8080 with MD5 checksums in encrypted POST packets documented.
- Multi-stage chain documented: AES-256-GCM JavaScript dropper writes PowerShell to settings.ps1; PowerShell downloads winpatch-xd7d.win from nvidiadriver[.]net; update.vbs launches chost.exe loader.py.
- Three malicious npm packages tied to account abdrizak identified: postcss-minify-selector-parser (XRAY-1002983), postcss-minify-selector (XRAY-1003986), aes-decode-runner-pro (XRAY-989675).
- JFrog Security Research (Yair Benamou) publishes 'From PostCSS Typosquat to Windows RAT', disclosing the campaign and IOCs.
- Threat ingested into Threadlinqs Intelligence; BeaconBeagle returned no prior C2 correlation for 95.216.92.207 or nvidiadriver[.]net.
Sources cited for Typosquatted npm Package postcss-minify-selector-parser
- From PostCSS Typosquat to Windows RAT (JFrog Security Research)
- Windows RAT Uses Encrypted HTTP C2 (Cyber Security News)
- Malicious npm Package Masquerades as PostCSS Utility to Deliver PowerShell Downloader (GBHackers)
- Malicious npm Packages Use PowerShell and VBS Chain to Drop Windows RAT (CyberPress)
- 8 Malicious npm Packages Deliver Multi-Layered Chrome Browser Information Stealer (JFrog blog, related)
- postcss-selector-parser (legitimate package being typosquatted) - npm
Detection coverage for TL-2026-0910
As of 2026-06-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0910 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.