Malicious npm Packages Impersonating PostCSS: Windows RAT Detection and Remediation

---
title: Potential Malicious npm Package Installation - PostCSS RAT
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects the installation of identified malicious npm packages associated with Windows RAT delivery in June 2026.
references:
 - https://thehackernews.com/2026/06/malicious-npm-packages-pose-as-postcss.html
author: Security Arsenal
date: 2026/06/02
tags:
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\npm.cmd'
      - '\npm.exe'
    CommandLine|contains:
      - 'aes-decode-runner-pro'
      - 'postcss-minify-selector'
      - 'postcss-minify-selector-parser'
  condition: selection
falsepositives:
  - Legitimate installation of a package with a similar name (unlikely given specific malicious strings)
level: critical
---
title: Suspicious Child Process from Node.js (RAT Activity)
id: b1c2d3e4-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects Node.js spawning suspicious Windows shell commands commonly associated with RAT deployment or execution.
references:
 - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/06/02
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'DownloadString'
      - 'IEX'
      - '/c'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate build scripts executing system commands
level: medium

// Hunt for installations of the specific malicious npm packages
DeviceProcessEvents
| where Timestamp > ago(30d)
| where ProcessCommandLine has_any ("npm install", "npm i")
| where ProcessCommandLine has_any ("aes-decode-runner-pro", "postcss-minify-selector", "postcss-minify-selector-parser")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| extend Severity = "High"

-- Hunt for the presence of the malicious package directories in node_modules
SELECT FullPath, Size, Mtime
FROM glob(globs="*/node_modules/aes-decode-runner-pro/*")
UNION ALL
SELECT FullPath, Size, Mtime
FROM glob(globs="*/node_modules/postcss-minify-selector/*")
UNION ALL
SELECT FullPath, Size, Mtime
FROM glob(globs="*/node_modules/postcss-minify-selector-parser/*")

# Remediation Script for Malicious npm Packages (June 2026)
# Requires Administrative Privileges

Write-Host "Starting scan for malicious npm packages..." -ForegroundColor Cyan

$MaliciousPackages = @( 
    "aes-decode-runner-pro", 
    "postcss-minify-selector", 
    "postcss-minify-selector-parser" 
)

$FoundThreats = $false

# Common locations for node_modules (User profile and global npm path)
$SearchPaths = @(
    "$env:USERPROFILE\node_modules",
    "$env:APPDATA\npm\node_modules",
    "C:\Program Files\nodejs\node_modules",
    "C:\Users\*\node_modules"  # Note: Wildcards require specific administrative tools, scanning current user drives primarily
)

# Scan current drive root for typical project structures
Get-PSDrive -PSProvider FileSystem | ForEach-Object {
    $DriveRoot = $_.Root
    Write-Host "Scanning Drive $DriveRoot..." -ForegroundColor Yellow
    
    foreach ($Package in $MaliciousPackages) {
        $Pattern = "*\node_modules\$Package"
        
        try {
            $DetectedPaths = Get-ChildItem -Path $DriveRoot -Filter $Package -Recurse -ErrorAction SilentlyContinue -Directory
            
            foreach ($Path in $DetectedPaths) {
                $FoundThreats = $true
                Write-Host "[THREAT FOUND] Malicious package detected at: $($Path.FullName)" -ForegroundColor Red
                
                # Attempt to remove the directory
                try {
                    Remove-Item -Path $Path.FullName -Recurse -Force
                    Write-Host "[REMOVED] Successfully deleted: $($Path.FullName)" -ForegroundColor Green
                }
                catch {
                    Write-Host "[ERROR] Failed to delete $($Path.FullName). Manual removal required." -ForegroundColor Red
                }
            }
        }
        catch {
            # Ignore access errors during scan
        }
    }
}

if (-not $FoundThreats) {
    Write-Host "No malicious packages found on local system." -ForegroundColor Green
} else {
    Write-Host "Remediation complete. Please rotate any credentials used on this machine since installation." -ForegroundColor Cyan
}