Malicious npm Packages Mimic PostCSS, Deliver Windows RAT

JFrog researchers reported on April 16, 2026, uncovering a new campaign deploying Windows remote access trojans (RATs) via malicious npm packages masquerading as PostCSS libraries. The attack specifically targets Windows developers through sophisticated software supply chain compromise. Attackers used highly obfuscated JavaScript payloads to initiate a multi-stage infection, bypassing standard static analysis and developer scrutiny. This campaign directly compromises development environments at the package installation level.

What Happened

Cybersecurity researchers at JFrog discovered several malicious npm packages designed to mimic legitimate PostCSS libraries, aiming squarely at Windows developers. These packages, including postcss-webpack-plugin, webpack-postcss-plugin, postcss-uglify, and postcss-less, along with other typosquatted variations, contained highly obfuscated JavaScript. The attack chain started when developers, often by mistyping a legitimate package name like postcss-loader, inadvertently installed one of these malicious npm packages.

Upon installation or use, the obfuscated JavaScript payload executed, initiating a multi-stage infection. This initial script downloaded further malicious scripts from attacker-controlled command-and-control (C2) servers. Specifically, JFrog identified api.npm-stat[.]com and cdn.jsdelivr-npm[.]info as C2 domains, according to The Hacker News. The downloaded scripts then deployed a custom Windows Remote Access Trojan onto the developer's machine. Before their removal from the npm registry, some of these packages had accumulated "hundreds to several thousand" weekly downloads, JFrog reported via BleepingComputer. The npm registry has since removed these packages. The exact number of affected developers or organizations has not been confirmed.

Why It Matters

This incident directly targets the software supply chain, posing a significant risk to organizations whose developers could have been compromised. A Windows RAT grants attackers extensive access to developer workstations, enabling system reconnaissance, file exfiltration, and potentially remote code execution. Attackers could steal sensitive data like source code, intellectual property, credentials, API keys, and configurations for development environments. This means direct access to your codebase, not just user data.

Compromising a developer's machine creates a beachhead for deeper network infiltration. An attacker with RAT access can move laterally, escalate privileges, and gain access to repositories, build systems, and production environments. Such an attack bypasses many traditional perimeter defenses. While this particular campaign does not involve ransomware, the potential for data theft and subsequent extortion or espionage is substantial, as highlighted by SecurityWeek.

Affected Scope & Remediation

Any Windows developer using npm who might have installed typosquatted postcss related packages is potentially exposed. This includes individual developers and, by extension, any organization whose development environment relies on npm and these specific libraries. JFrog confirmed that malicious packages such as postcss-webpack-plugin and webpack-postcss-plugin were removed from the npm registry following their report.

Immediately:

1. Audit Developer Workstations: Scrutinize package.json files and installed npm dependencies across all Windows development machines for the identified malicious packages. Look for postcss-webpack-plugin, webpack-postcss-plugin, postcss-uglify, postcss-less, and any similar, slightly misspelled variations.
2. Network Monitoring: Block network connections to the identified C2 domains: api.npm-stat[.]com and cdn.jsdelivr-npm[.]info. Monitor your network for any outbound traffic to these or similar suspicious domains.
3. Endpoint Protection: Deploy endpoint detection and response (EDR) solutions like CrowdStrike Falcon or SentinelOne on developer machines. These tools can detect unusual process activity, script execution, and suspicious network connections indicative of RAT deployment and activity.
4. Developer Education: Reinforce security awareness training focusing on typosquatting, dependency confusion, and verifying package legitimacy (e.g., checking download counts, maintainer details, and GitHub repositories before installation).
5. IoC Scanning: Scan developer environments for the presence of unusual executables or scripts in temporary directories or user profiles, which could be remnants of the multi-stage infection.

No specific CVE is associated with this incident, as it involves malicious packages rather than a software vulnerability requiring a patch. Therefore, there are no "affected vs. patched versions" in the traditional sense. Remediation means removal and prevention.

Technical Breakdown

The attack capitalizes on developer muscle memory and the sheer volume of npm packages. Think of it like a chef accidentally grabbing a tainted ingredient from a poorly labeled jar in a massive pantry. The malicious npm packages were crafted to look like popular PostCSS tools, differing only by a single character or a swapped word – classic typosquatting. Once a developer installs one, the package executes highly obfuscated JavaScript code during the npm install or build process. This initial script acts as a dropper.

This dropper then establishes an outbound connection to a command-and-control (C2) server. It uses this connection for T1105 Ingress Tool Transfer, downloading subsequent stages of the malicious payload. These stages are often more sophisticated scripts or executables. The final payload is a custom Windows Remote Access Trojan (RAT), which achieves T1219 Remote Access Software capability, allowing the attacker to remotely control the compromised developer machine. The RAT then performs T1041 Exfiltration Over C2 Channel, sending collected data back to the attacker's infrastructure. Attackers used T1027 Obfuscated Files or Information to hide the malicious intent of their JavaScript, making detection harder for automated tools and human review.

This entire sequence falls under T1195.002 Compromise Software Supply Chain, as the attack targets the integrity of the open-source software delivery pipeline. From a defensive perspective, this incident highlights NIST SP 800-53 control SI-3 Malicious Code Protection, emphasizing the need for granular controls to prevent, detect, and recover from malicious code. It also underscores SA-10 Developer Configuration Management, requiring secure configuration and monitoring of developer environments and tools.

Historical Context

This campaign isn't an isolated incident; it mirrors a growing trend in software supply chain attacks. A similar, large-scale incident occurred in October 2024, where JFrog reported "hundreds" of malicious npm packages were discovered delivering an infostealer, also leveraging typosquatting techniques. That campaign, much like the PostCSS incident, exploited developer trust and the sheer volume of available open-source dependencies. While the 2024 incident delivered an infostealer aimed at harvesting credentials, this new campaign delivers a full Windows RAT, indicating a shift towards deeper system compromise and potentially more persistent access. Both, however, share the common thread of targeting developers at the dependency installation phase, leveraging dependency confusion and typo-squatting to achieve initial access.

Data at a Glance

Our Take

We've seen these supply chain attacks evolve. The obfuscation level in these PostCSS packages demonstrates attackers are putting more effort into evading detection, pushing past simple keyword scans. This isn't just about catching known malware; it's about anticipating polymorphic behaviors and runtime analysis evasion. Developers are increasingly becoming high-value targets, and their environments need the same level of security scrutiny as production systems.

The CVEDaily Take

This campaign underscores the persistent threat to the open-source ecosystem and the need for rigorous vetting of dependencies. Relying solely on official registries isn't enough when typosquatting remains effective. How often does your team perform automated dependency vulnerability scanning and integrity checks on developer workstations?

FAQ

Q: What is PostCSS, and why was it targeted?
A: PostCSS is a software tool that uses JavaScript plugins to automate routine CSS operations. It's a popular dependency in many web development projects, making it a high-value target for attackers who can gain widespread compromise by mimicking its legitimate packages and exploiting developer trust.

Q: How can developers protect themselves from similar malicious npm packages?
A: Developers should use tools like npm audit and snyk to regularly scan dependencies for known vulnerabilities. More critically, they must verify package legitimacy by checking the GitHub repository, maintainer details, and weekly download counts before installing. Implementing private npm registries with vetted packages can also help.

Q: What kind of data is at risk if a developer's machine is infected with this RAT?
A: A Windows RAT grants attackers extensive control, potentially compromising source code, intellectual property, API keys, internal network credentials, and sensitive configuration files stored on the developer's machine. This can lead to broader corporate espionage or further supply chain attacks.