Malicious npm Packages Impersonate PostCSS to Deliver Windows RAT

Overview of the PostCSS Typosquatting Campaign

Security researchers have identified a targeted Supply Chain Attack involving the publication of malicious packages to the npm registry. According to The Hacker News, these packages are designed to impersonate popular tools in the PostCSS ecosystem to deliver a Windows-based C2 payload.

The identified packages—specifically aes-decode-runner-pro, postcss-minify-selector, and postcss-minify-selector-parser—leverage typosquatting and brand impersonation to deceive developers into integrating them into their build pipelines. While the total download count remains relatively low, with approximately 1,000 combined downloads at the time of discovery, the nature of the payload indicates a targeted attempt to gain long-term persistence on developer workstations.

How to Detect Malicious npm Packages in Build Pipelines

A primary concern for SOC teams is identifying these threats before they execute in a sensitive environment. The TTP used in this campaign follows a pattern where the package manifest (package.json) contains a script that triggers the download of an external executable. This is a common method for achieving RCE during the package installation phase, often hidden within preinstall or postinstall hooks.

Defenders should look for suspicious outbound network connections originating from build servers or developer machines, particularly those targeting unknown domains or direct IP addresses associated with C2 infrastructure. Integrating automated scanning tools into CI/CD pipelines can help identify these threats; however, manual auditing remains necessary when using less common or newly published packages. Implementing npm supply chain attack protection involves restricted use of unverified packages and continuous monitoring of dependency trees.

Technical Analysis of the Malware Delivery

The core of the attack lies in the obfuscation of the malicious payload. Once a developer installs one of the compromised packages, a script executes to determine the host operating system. Currently, the campaign appears exclusively focused on Windows environments. The malware establishes a persistent connection to an attacker-controlled server, allowing for data exfiltration and the execution of further commands.

This specific campaign highlights why developers must be vigilant about the libraries they import. The use of postcss-minify-selector-parser is particularly deceptive, as it mimics the naming structure of legitimate PostCSS plugins. By providing seemingly functional or plausible package names, the attacker increases the likelihood that the malicious code will reside in a codebase for an extended period without detection.

Mitigation and Response to PostCSS Typosquatting Malware

To mitigate the risk of PostCSS typosquatting malware, organizations should enforce strict package versioning and use lockfiles to ensure consistent and verified dependencies. Furthermore, the use of private npm proxies can help gatekeep which packages are permitted within the corporate network, preventing direct pulls from the public registry for unvetted tools.

If a compromise is suspected, the following steps are recommended:

• Terminate any processes associated with the malicious npm installation immediately.
• Utilize EDR solutions to hunt for unusual PowerShell or CMD processes spawned by Node.js or npm processes.
• Review SIEM logs for IoC markers related to the identified package names and their associated download domains.
• Audit all environment variables and secrets stored on the affected machine, as the Windows RAT likely attempted to harvest these credentials for further Lateral Movement.

Finally, security teams should update their threat models to include the risk of malicious development dependencies. Proactive monitoring of the MITRE ATT&CK framework’s “Supply Chain Compromise” technique provides a structured way to defend against these persistent threats.