Malicious NPM Packages Deliver Windows RAT, Researchers Warn

Security researchers have identified a trio of malicious npm packages that deliver a Windows-based remote access trojan (RAT).

The compromised packages—aes-decode-runner-pro, postcss-minify-selector, and postcss-minify-selector-parser—have attracted 145, 256, and 615 downloads respectively.

All three were published over the past month by a single npm user, indicating a coordinated effort.

The malicious code is designed to install a RAT that grants attackers full control over the victim’s machine.

The packages masquerade as legitimate utilities, making them difficult to detect through standard package vetting.

Developers are urged to audit their dependencies and remove any of the flagged packages from their projects.

The incident highlights the importance of maintaining a strict package review process.

The attackers may continue to publish similar malicious packages if left unchecked.