---
id: 2522
title: "RATatouille: A Malicious Recipe Hidden in rand-user-agent (Supply Chain Compromise)"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/catching-a-rat-remote-access-trojian-rand-user-agent-supply-chain-compromise"
published_at: "2025-05-06 00:00"
tags: ["supply-chain", "malware", "npm", "c2", "supply-chain-attack", "file-exfiltration", "rat", "rand-user-agent", "npm-malware", "socket-io", "path-hijack"]
phying_url: "https://phying.com/item/2522"
lang: en
---

# RATatouille: A Malicious Recipe Hidden in rand-user-agent (Supply Chain Compromise)

## Summary

A supply chain attack hit the rand-user-agent npm package: hidden code deployed a RAT with socket.io C2 channels, file exfiltration, and a Python PATH hijack across versions released after 2.0.82.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2025-05-06 00:00
- **Original:** https://www.aikido.dev/blog/catching-a-rat-remote-access-trojian-rand-user-agent-supply-chain-compromise
- **Phying News:** https://phying.com/item/2522