RATatouille: Remote Access Trojan Discovered in Popular NPM Project
CybersecurityHackingMalwareSupplyChain
The npm package rand-user-agent has been compromised by a remote access trojan (RAT) hidden in the dist/index.js file through whitespace. This RAT executes upon importation and allows remote access, file downloads, and PATH manipulation. The affected versions are 1.0.110, 2.0.83, and 2.0.84. Access was obtained via a compromised npm token, not through GitHub.