Affected Systems
Three npm packages (aes-decode-runner-pro, postcss-minify-selector, postcss-minify-selector-parser) published within the past month. Total downloads: 145-615 per package. Affects Windows-based development environments using npm package manager.
Exploitation Status
Active supply chain attack. Malicious packages were live on npm registry and downloaded by developers. Packages have been identified and likely removed, but compromised systems remain at risk.
Business Impact
Development teams using npm may have installed malicious packages, resulting in RAT deployment on Windows developer workstations. Compromised machines could provide attackers with persistent access to source code, credentials, internal networks, and CI/CD pipelines. No CVE assigned as this is a supply chain poisoning attack rather than a software vulnerability.
Urgency
🟠Within 24 hours
Recommended Actions
- Audit package.json and package-lock.json files across all projects for the three malicious packages: aes-decode-runner-pro, postcss-minify-selector, postcss-minify-selector-parser
- Scan developer workstations that performed npm installs in the past 30 days for indicators of compromise, focusing on Windows systems
- Review npm audit logs and registry access patterns to identify which teams or systems may have downloaded the malicious packages
- Implement npm package verification using tools like Socket Security or Snyk to detect suspicious package behavior before installation
- Rotate credentials and secrets accessible from any developer workstation that installed the identified packages