Malicious npm Package PostCSS Typosquat node.exe Spawning PowerShell

Ethan Andrews@eandrews

•updated Jun 23, 2026•2•0•6

Detects node.exe spawning powershell.exe as a child process, consistent with malicious npm postinstall lifecycle hooks used by the PostCSS typosquatting campaign (postcss-minify-selector-parser / postcss-minify-selector). The attack chain decrypts an AES-256-GCM blob at runtime and executes a PowerShell downloader stage.