Back Thehackernews

Malicious npm Packages Pose as PostCSS Tools to Deliver Windows RAT

Thehackernews • June 23, 2026

Learn how to uncover hidden AI use, see what data it can access, map every AI action to a human owner, and apply practical governance without heavy infrastructure changes.

Learn how to contain Mythos-style AI attacks with practical Zero Trust controls that reduce exposure, stop lateral movement, and limit risk.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious npm Packages Deliver Windows RAT via PostCSS Impersonation A malicious npm package named postcss-minify-selector-parser has been discovered, masquerading as a legitimate PostCSS utility. This package is delivering a multi-stage Windows remote access trojan (RAT). It mimics the widely used postcss-selector-parser library, which has over 150 million weekly downloads, by reusing similar keywords. The attack targets developers using npm, potentially compromising their systems. The malicious package exploits the trust placed in popular libraries, leading to significant risks for users. Current reports indicate that the package has been identified and flagged, but the full extent of the impact is still being assessed. Users are advised to check their dependencies for this malicious package. 4 sources 68

Extracted Entities

Malicious npm Packages Pose as PostCSS Tools to Deliver Windows RAT

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

Platforms (2)

Tools (1)