Fake npm Packages Deliver RAT to Steal Chrome Credentials

Attackers published malicious npm packages impersonating the widely-used PostCSS tool to trick developers into installing a Windows Remote Access Trojan. This is a classic supply chain attack leveraging typosquatting and name impersonation to exploit developer trust in open-source ecosystems. Once installed, the RAT bypasses Chrome's encryption to harvest saved credentials, turning a developer's workstation into a data exfiltration point. The incident highlights how a single careless package installation can compromise both individual machines and, potentially, entire CI/CD pipelines and production environments downstream.

Tactical Insight

Immediate actions

Audit all current npm dependencies against known-good package registries and remove any unverified or suspicious packages immediately.
Rotate all credentials stored in Chrome or other browsers on any developer machine that may have installed these packages.
Report the malicious packages to the npm security team for takedown to protect the wider community.

Long-term improvements

Enforce the use of a private or proxied npm registry (e.g., Artifactory, Verdaccio) that vets and mirrors only approved packages.
Implement a software composition analysis (SCA) tool in your CI/CD pipeline to automatically flag unrecognized or suspicious package publishers.
Establish a policy requiring peer review and verification of any new third-party dependency before it is added to a project.

Detection measures

Deploy endpoint detection and response (EDR) tools capable of identifying RAT behavior such as unexpected outbound connections or credential-store access.
Enable behavioral monitoring on developer workstations to alert on processes attempting to read browser credential files.
Integrate npm audit and tools like Socket.dev into automated build pipelines to continuously scan for newly flagged malicious packages.