RATatouille: A Malicious Recipe Hidden in rand-user-agent (Supply Chain Compromise)
aikido.dev | blog | #supply-chain | #malware | #npm | #c2 | #supply-chain-attack | #file-exfiltration | #rat | #rand-user-agent | #npm-malware | #socket-io | #path-hijack
Summary
A supply chain attack hit the rand-user-agent npm package: hidden code deployed a RAT with socket.io C2 channels, file exfiltration, and a Python PATH hijack across versions released after 2.0.82.
- Published
- Collected
--- id: 2522 title: "RATatouille: A Malicious Recipe Hidden in rand-user-agent (Supply Chain Compromise)" source_domain: aikido.dev source_url: "https://www.aikido.dev/blog/catching-a-rat-remote-access-trojian-rand-user-agent-supply-chain-compromise" published_at: "2025-05-06 00:00" tags: ["supply-chain", "malware", "npm", "c2", "supply-chain-attack", "file-exfiltration", "rat", "rand-user-agent", "npm-malware", "socket-io", "path-hijack"] phying_url: "https://phying.com/item/2522" lang: en --- # RATatouille: A Malicious Recipe Hidden in rand-user-agent (Supply Chain Compromise) ## Summary A supply chain attack hit the rand-user-agent npm package: hidden code deployed a RAT with socket.io C2 channels, file exfiltration, and a Python PATH hijack across versions released after 2.0.82. ## Intelligence Metadata - **Sources:** aikido.dev - **Published:** 2025-05-06 00:00 - **Original:** https://www.aikido.dev/blog/catching-a-rat-remote-access-trojian-rand-user-agent-supply-chain-compromise - **Phying News:** https://phying.com/item/2522