Upon analysis, the malicious payload was identified as a sophisticated Remote Access Trojan (RAT) dubbed “RATatouille” due to its capability to hide among legitimate code while establishing persistence. Security analysis reveals the malware versions attempt to evade detection by employing multiple layers of obfuscation and establishing a hidden node_modules directory in the user’s home folder to store additional malicious components. Aikido Push researchers identified the malware through their automated analysis pipeline, noting how attackers concealed their code by hiding it beyond the normal horizontal scroll view in the package’s distribution files. The compromise affects a legitimate JavaScript library used to generate randomized user-agent strings for web scraping operations, inserting malicious code that establishes remote access capabilities on infected systems. Organizations using any version of rand-user-agent published after October 2024 should immediately check for indicators of compromise, particularly unauthorized network connections to the identified C2 infrastructure and unexpected modifications to Python environment paths. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Security researchers detected suspicious code in version 1.0.110 of the package, which was published without authorization from the original maintainers at WebScrapingAPI. This PATH manipulation allows attackers to execute malicious binaries whenever a Python-related command is triggered, effectively hijacking legitimate Python operations. The package remained uncompromised for years until this recent incident, with the last legitimate version (2.0.82) published seven months ago according to the official GitHub repository. The embedded malware constructs covert communication channels with command-and-control infrastructure at 85.239.62[.]36, using both port 3306 for socket connections and port 27017 for file exfiltration. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. A sophisticated supply chain attack targeting the popular npm package ‘rand-user-agent’ was discovered on May 5, 2025. The attack is particularly concerning given that ‘rand-user-agent’ averages approximately 45,000 weekly downloads, creating a wide potential attack surface across development environments. The malware hides its code in the distribution file by placing it beyond the visible area of code editors. Tushar is a Cyber security content editor with a passion for creating captivating and informative content.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 09 May 2025 15:05:13 +0000