# Typosquatted npm Package postcss-minify-selector-parser Delivers Nuitka-Compiled Windows RAT with RC4-Encrypted HTTP C2

> JFrog Security Research disclosed a malicious npm package, postcss-minify-selector-parser, that typosquats the legitimate postcss-selector-parser (150M+ weekly downloads) to deliver a full-featured Windows RAT. A multi-stage chain (AES-256-GCM JavaScript dropper to PowerShell downloader to VBS bootstrapper to a Nuitka-compiled Python implant) establishes RC4/ARC4-encrypted HTTP C2 to 95.216.92.207:8080, steals Chrome credentials including app-bound-encrypted secrets, detects virtual machines, and persists via an HKCU Run key named csshost.

- **Published:** 2026-06-23T00:00:00Z
- **Last reviewed:** 2026-06-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0910
- **ID:** TL-2026-0910
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 22 June 2026, JFrog Security Research (Yair Benamou) published 'From PostCSS Typosquat to Windows RAT', detailing an active npm supply-chain campaign. The npm account abdrizak published three malicious packages: postcss-minify-selector-parser (XRAY-1002983, the primary lure), postcss-minify-selector (XRAY-1003986), and aes-decode-runner-pro (XRAY-989675). The primary package mimics the trusted postcss-selector-parser by reusing the postcss/selector/parser/css keyword space and even declaring the genuine package as a dependency so it appears credible during a quick dependency review.

The infection chain is multi-stage. An encoded blob hidden in src/config/defaults.js (loaded via the index.js entry point) decodes through an internal chain that includes AES-256-GCM, yielding a JavaScript dropper. That dropper writes a PowerShell script to ../../settings.ps1 and executes it with a bypassed execution policy. The PowerShell stage acts as a downloader, retrieving a Windows bundle from the lookalike domain nvidiadriver[.]net (URL hxxp://nvidiadriver[.]net/verv1432/winpatch-xd7d[.]win), saving it as %TEMP%\winPatch.zip and extracting it into %TEMP%\winPatch. A VBS bootstrapper, update.vbs, then expands an inner dll.zip with tar and launches the implant via a renamed Python launcher: chost.exe loader.py (bundled with python310.dll).

The final implant is a Python application compiled with Nuitka into native .pyd extension modules, making static inspection substantially harder than a typical script threat. Functionality is split across modules: audiodriver (main RAT orchestration), api (HTTP C2 packet exchange), command (host actions and shell execution), config (RAT configuration), auto (Chrome credential theft) and util (archive helper). The RAT enforces single-instance execution, stores a persistent victim UUID (%TEMP%.store) and host configuration (%TEMP%.host), and persists across reboots via the registry Run key HKCU\Software\Microsoft\Windows\CurrentVersion\Run with the value name csshost.

C2 is HTTP-based to 95.216.92.207:8080. All traffic is wrapped with RC4/ARC4 stream encryption and carries MD5 checksums embedded inside the encrypted POST packets for integrity, defeating naive network-content detection. The implant first sends a host profile (including VM checks) then loops awaiting commands, supporting remote shell execution, file upload/download tunneled through the C2 protocol, and randomized sleep for evasion. The auto module performs Chrome credential theft: it reads Chrome's Local State and Login Data SQLite database and decrypts stored secrets via Windows DPAPI, with additional AES-GCM and ChaCha20-Poly1305 handling so that even newer app-bound-encryption-protected credentials are recovered. It also collects Chrome extension data and stages output as chrome_logins_dump.txt inside an in-memory gather.tar.gz archive prior to exfiltration. Sandbox/VM evasion cross-references network adapter MAC address prefixes against known virtualization vendors (VMware, VirtualBox, QEMU) and uses WMI queries for environment profiling.

No CVE is assigned; this is a malicious-package supply-chain compromise rather than a product vulnerability. Named IOCs (the C2 IP, the delivery domain, three npm packages, and six .pyd SHA-256 hashes) are published, enabling immediate blocking and hunting. BeaconBeagle queries for the C2 IP 95.216.92.207 and the domain nvidiadriver[.]net returned no existing C2-framework correlation at time of research.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1497 Virtualization/Sandbox Evasion
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1497 Virtualization/Sandbox Evasion
- T1016 System Network Configuration Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel

## Sources

- [From PostCSS Typosquat to Windows RAT (JFrog Security Research)](https://research.jfrog.com/)
- [Windows RAT Uses Encrypted HTTP C2 (Cyber Security News)](https://cybersecuritynews.com/windows-rat-uses-encrypted-http-c2/)
- [Malicious npm Package Masquerades as PostCSS Utility to Deliver PowerShell Downloader (GBHackers)](https://gbhackers.com/npm-package-masquerades-as-postcss/)
- [Malicious npm Packages Use PowerShell and VBS Chain to Drop Windows RAT (CyberPress)](https://cyberpress.org/npm-packages-drop-rat/)
- [8 Malicious npm Packages Deliver Multi-Layered Chrome Browser Information Stealer (JFrog blog, related)](https://jfrog.com/blog/malicious-npm-packages-chrome-browser-information-stealer/)
- [postcss-selector-parser (legitimate package being typosquatted) - npm](https://www.npmjs.com/package/postcss-selector-parser)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0910