Malicious npm Package Masquerades as PostCSS Utility to Deliver PowerShell Downloader

A malicious npm package, postcss-minify-selector-parser, has been discovered masquerading as a benign PostCSS utility and delivering a multi-stage Windows remote access trojan (RAT).

The imposter deliberately mimics the widely used postcss-selector-parser a legitimate library with more than 150 million weekly downloads by reusing the same keyword space (postcss, selector, parser, css) and depending on the real package to appear credible during quick dependency reviews.

Unlike simple typosquats that change a single character, this package’s name is plausibly close enough to evade cursory inspection while still being distinct.

The blob decodes via an internal chain that includes AES-256-GCM and results in a JavaScript dropper which writes and executes a PowerShell script at ../../settings.ps1 using a bypassed execution policy.

That PowerShell stage functions as a downloader: it retrieves a Windows bundle from nvidiadriver[.]net (curling a file named winpatch-xd7d.win), extracts it into %TEMP%\winPatch, and launches a VBS bootstrapper (update.vbs).

The domain and filenames are designed to masquerade as legitimate driver or patch artifacts.

According to JFrog, Static analysis of the package revealed a surprising payload hidden behind a large encoded blob in src/config/defaults.js, which is loaded immediately when index.js is required (index.js is declared as the package entry point).

The downloaded bundle is a sophisticated, layered Windows implant containing a bundled Python runtime, a renamed Python launcher chost.exe, Nuitka-compiled Python extension modules (.pyd), and supporting files such as python310.dll and dll.zip.

npm Package Masquerades as PostCSS

The VBS bootstrapper extracts dll.zip and executes chost.exe loader.py, which behaves equivalently to running Python on loader.py.

The loader imports audiodriver (a compiled module) to begin the RAT logic. Analysis of embedded RT_RCDATA resources and module names allowed reconstruction of the malware’s structure and command flow.

Recovered configuration and module behavior point to an HTTP-based command-and-control (C2) server at hxxp[:]//95[.]216[.]92[.]207:8080 and use of RC4/ARC4-wrapped packet transport with MD5 checksums inside encrypted POST packets.

The RAT supports registry persistence via HKCU\Software\Microsoft\Windows\CurrentVersion\Run, single-instance enforcement, victim UUID storage, host profiling with VM checks, remote shell, file upload/download tunneled through the C2 protocol, and Chrome credential and extension data theft.

The Chrome theft module references Local State and Login Data files and invokes Windows decryption APIs (DPAPI and NCrypt) to extract stored credentials, producing artifacts like chrome_logins_dump.txt and in-memory archives such as gather.tar.gz.

Investigators also identified two related packages published by the npm account abdrizak: aes-decode-runner-pro and postcss-minify-selector.

Both aes-decode-runner-pro and postcss-minify-selector-parser present themselves as AES or codec utilities and depend on the real postcss-selector-parser; postcss-minify-selector depends on postcss-minify-selector-parser.

Decoded blobs from aes-decode-runner-pro and postcss-minify-selector-parser both lead to the same PowerShell downloader and Windows payload chain, confirming a coordinated campaign.

At the time of reporting, the malicious package remained live and accessible on the npm registry. Defenders should treat lookalike or contextually plausible dependencies as high risk, not mere naming noise.

Immediate remediation steps include removing postcss-minify-selector-parser, postcss-minify-selector, and aes-decode-runner-pro; inspecting dependency trees for transitive pulls; blocking the network indicators; searching Windows hosts for %TEMP%\winPatch, %TEMP%.store, %TEMP%.host, and chost.exe loader.py activity; and checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run for a csshost value.

Developers who may have installed these packages should rotate credentials and developer tokens, especially browser-stored secrets.

IOCs

SHA-256	File
164e322d6fbc62e254d73583acd7f39444c884d3f5e6a5d27db143fc25bc88b3	win-driver-xd7d/audiodriver.cp310-win_amd64.pyd
50ffce607867d8fa8eaf6ef5cd25a3c0e7e4415e881b9e55c04a67bcddb74fdf	win-driver-xd7d/api.cp310-win_amd64.pyd
17832aa629524ef6e8d8d6e9b6b902a8d324b559e3c36dbd0e221ab1690be871	win-driver-xd7d/auto.cp310-win_amd64.pyd
c8075bbff748096e1c6a1ea0aa67bb6762fdd7551427a12425b35b94c1f1ecf2	win-driver-xd7d/command.cp310-win_amd64.pyd
f6669bd504ce6b0e303be7ee47f2ebbc062989c88c41f0a3f436044a24869798	win-driver-xd7d/config.cp310-win_amd64.pyd
282b9bc318ad1234cbd1b86424b784299b8be31545802a7c6b751166b814b990	win-driver-xd7d/util.cp310-win_amd64.pyd

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.