Malicious npm Packages Pose as PostCSS Tools to Deliver Windows RAT

Cybersecurity researchers have discovered a set of malicious npm packages that are designed to deliver a Windows-based remote access trojan (RAT). The list of identified packages, is below - aes-decode-runner-pro (145 downloads) postcss-minify-selector (256 downloads) postcss-minify-selector-parser (615 downloads) All the packages were published over the past month by an npm user named

Researchers reported that several malicious npm packages impersonating PostCSS-related tools were uploaded to the registry and used to deliver a Windows remote access trojan (RAT) to developer machines.[3][4][10] The RAT is capable of stealing browser credentials, executing commands, and transferring files, indicating a classic software supply chain compromise via open-source dependencies.[3][4] From a CyberSE.AI perspective, any AI-enabled development or deployment pipeline that consumes npm packages inherits this risk: poisoned dependencies can become a path to compromise AI agents, model-serving infrastructure, or CI/CD systems. Organizations should enforce SBOM-driven dependency governance, automated scanning for malicious/typosquatted packages, and continuous red teaming of AI-related build and deployment flows to detect supply chain abuse early.