Malicious npm Package Masquerades as PostCSS Utility to Deliver PowerShell Downloader

A malicious npm package, masquerading as the legitimate postcss-selector-parser, was found delivering a multi-stage Windows RAT: an encoded JavaScript dropper unpacks a PowerShell downloader which retrieves a Windows bundle containing a bundled Python runtime and compiled extension modules. The RAT implements persistence, single-instance enforcement, VM checks, remote shell and file transfer capabilities, and a Chrome credential-theft module; static analysis recovered C2 infrastructure (http://95.216.92.207:8080), multiple SHA-256 IOCs, and related malicious npm packages, with remediation guidance to remove affected packages, scan dependency trees, block network indicators, and search for artifact names like %TEMP%\winPatch and chost.exe.