From PostCSS Masquerading to Windows RAT

A sophisticated supply chain attack leverages typosquatting of the legitimate postcss-selector-parser npm package, which receives over 150 million weekly downloads. Three malicious packages published by user 'abdrizak' masquerade as PostCSS utilities while delivering a multi-stage Windows RAT. The infection chain begins with encoded JavaScript that drops PowerShell scripts, which then download a bundled Python runtime containing Nuitka-compiled modules. The final payload implements comprehensive RAT capabilities including HTTP C2 communication with RC4 encryption, registry persistence, VM detection, remote shell execution, file transfer, and Chrome credential theft using DPAPI and app-bound decryption. The attack demonstrates how build tooling dependencies can serve as delivery mechanisms for sophisticated Windows malware targeting developer environments.

• Black October for AI Developer PlatformsCampaign2026-10-31
• DarkCore: A Data-Theft RAT With a Session-Hijacking BrowserMalware2026-10-27
• ARTEX abuse expands as cybercriminals target financial sectorAnalysis2026-11-07
• Email threat landscape: Q3 2026 trends and insightsAnalysis2026-11-05
• Inside Phexia: A macOS malware delivered through ClickFixMalware2026-11-05