PostCSS RAT Persistence via Registry Run Key by chost.exe
Detects persistence from the postcss-minify-selector-parser npm typosquat Windows RAT (JFrog, Jun 2026). The Python/Nuitka implant (launched as chost.exe, a renamed python.exe running loader.py) writes an HKCU Run value named 'csshost'. Fires on a CurrentVersion\Run write where the value name is csshost OR the writing process is chost.exe.
YARA-L
