Executive Summary
A sophisticated typosquatting campaign published by the actor 'abdrizak' has been identified targeting the JavaScript ecosystem. By masquerading as legitimate PostCSS utilities, the attacker leverages the popularity of the 'postcss-selector-parser' package (150M+ weekly downloads) to lure developers into installing malicious lookalike dependencies.
The attack chain progresses from an AES-encrypted JavaScript blob within the npm package to a PowerShell downloader, which eventually retrieves a Nuitka-compiled Python bundle. This final payload is a comprehensive Windows Remote Access Trojan (RAT) capable of remote shell execution, file manipulation, and Chrome credential theft. The use of deceptive domain names like 'nvidiadriver[.]net' and renamed executables like 'chost.exe' demonstrates a clear intent to evade detection by blending into legitimate system activity.
This campaign poses a significant risk to development organizations, as the malware specifically targets browser-stored credentials and session data, which are often used to access sensitive corporate repositories and cloud environments.