Lookalike npm Package Hides a Multi-Stage Windows RAT

A broad set of high-impact cybersecurity developments: JFrog found a typo‑squatting npm package impersonating postcss‑selector‑parser that drops a multi‑stage Windows RAT; Microsoft links a Mastra AI supply‑chain compromise to North Korean group Sapphire Sleet; a Klue breach exposed OAuth tokens enabling attackers to compromise multiple cybersecurity firms. Other notable threats include GentleKiller (an EDR‑killing framework used by Gentlemen ransomware affiliates), an unpatchable Apple BootROM USB flaw affecting A12/A13 devices, continued FortiBleed fallout for Fortinet customers, and large‑/