A Lookalike npm Name, Then a Windows Script Chain: The Supply-Chain Trap Behind a RAT Drop

In package registries, trust often starts with a name. That is exactly why typosquatting remains such an effective delivery method: one misleading label can be enough to move a developer from routine installation to malicious code execution. In this case, the lure package used a name close to a legitimate PostCSS library, then relied on Windows scripting tools to stage a remote-access Trojan.

Fast Facts

• The malicious package name closely resembled postcss-selector-parser.
• The campaign used a PowerShell and VBScript chain as part of its execution path.
• The final payload was described as a Windows RAT, but the exact family was not identified.
• No victim count, install count, or attribution to a specific threat actor was provided.
• The case fits a broader software-supply-chain pattern: trust the package name, then abuse built-in interpreters.

What matters technically

The important detail is not just that a malicious package existed, but how it bridged two trust zones. First came typosquatting: a package name designed to look close enough to a known library that it could be installed by mistake. npm documentation treats confusingly similar names as a known risk because public registries are searchable by humans, not just scanners.

After installation, the chain moved into PowerShell and VBScript. That matters because both are native Windows execution surfaces. From a defender’s perspective, native scripting is useful to attackers precisely because it can blend into normal administration, especially on developer workstations and build agents where scripts are common.

This is a classic staged-loader pattern. The package name is the lure, the script layer is the bridge, and the RAT is the final payload. Even when the malware family is unknown, the delivery method tells its own story: attackers often prefer built-in tools over dropped binaries because those tools are already present on the system.

That creates a narrow but important detection opportunity. Security teams can watch for unusual script execution that follows package installs, especially PowerShell launched from development contexts or VBScript invoked by a newly added dependency. Package review should also flag hidden or runtime-decoded behavior, since code that does not appear upfront can be harder to notice during normal inspection.

At the time of writing, the exact RAT family, the threat actor, and the campaign scale remain unconfirmed. The available information supports a risk analysis, not a definitive claim about broader compromise or downstream impact.

Conclusion

The lesson is simple and uncomfortable: in software supply chains, a single misleading name can be enough to redirect trust into execution. Once the attacker reaches Windows-native scripting, the line between an ordinary install and a live intrusion can disappear fast. For defenders, the practical response is not just malware hunting, but skepticism toward package names, script behavior, and anything that turns a dependency into a launcher.

TECHCROOK

Hardware security key: Useful for protecting npm, GitHub, and other developer accounts with phishing-resistant MFA. It won’t stop a malicious package from being installed, but it can make it harder for attackers to turn a stolen password into registry access or publishing rights.

Scheda Techcrook: Hardware security key

WIKICROOK

• Typosquatting: Registering a package name that closely resembles a popular one to trick users into installing it.
• PowerShell: A Windows command and scripting environment often abused for malicious execution and staging.
• VBScript: A Windows scripting language that can be used to launch commands or chain additional payloads.
• Remote Access Trojan (RAT): Malware designed to give an operator remote control over an infected system.
• Software Supply Chain: The path software takes from development and packaging to installation on a target system.