Stealthy npm Package Breach Exposes Thousands to Remote Access Malware
On May 5, 2025, a covert supply chain breach was uncovered involving the npm package rand-user-agent, a tool frequently used in web scraping workflows to generate randomized user-agent headers. This attack marks a serious escalation in JavaScript package ecosystem threats, embedding a stealth Remote Access Trojan (RAT) into a widely trusted library.
The infected package, now linked to over 45,000 weekly downloads, was manipulated to establish unauthorized remote access on systems that integrated it. The breach bypassed original maintainers from WebScrapingAPI, with version 1.0.110 slipping into the npm registry unnoticed until security researchers intervened.
Aikido Push’s automated threat detection flagged the altered release, which obscured malicious code within horizontally hidden segments of its source files. This tactic allowed the malware to evade superficial inspection, raising the alarm only after deeper static and behavioral analysis.
Further investigation traced the embedded threat to a newly identified RAT dubbed “RATatouille”, named for its deceptive ability to blend into benign code while executing persistent backdoor operations. The malware initiated outbound traffic to a command-and-control server at IP 85.239.62[.]36, establishing communication via port 3306 and exfiltrating data through port 27017.
Once executed, the RAT harvested system metadata—including machine name, current user, OS type, and process identifiers—before transmitting the intel to remote operators. Additional evasion layers included heavy obfuscation and deployment of a shadow node_modules directory under the user’s home path, allowing the malware to download and run auxiliary payloads without detection.
Breakdown of the Infection Strategy
RATatouille’s execution chain begins by dynamically loading commonly used libraries like socket.io-client and axios. If absent, these are silently pulled into a rogue dependency directory—ensuring independence from the host project’s legitimate module tree.
A standout feature of this malware is its targeted exploitation of Windows PATH variables, particularly those associated with Python. The malware rewrites the system PATH to prioritize a fabricated Python path:
js
const Y = path.join(
process.env.LOCALAPPDATA || path.join(os.homedir(), ‘AppData’, ‘Local’),
‘Programs\Python\Python3127’
)
env.PATH = Y + ‘;’ + process.env.PATH
By positioning its binaries ahead of legitimate Python installations, the malware hijacks execution contexts for Python-based processes, enabling covert activation of malicious payloads during routine operations.
Timeline of Compromised Versions
The official GitHub repository confirms that version 2.0.82 was the last authentic release, posted roughly seven months ago. Since then, three tainted versions—1.0.110, 2.0.83, and 2.0.84—have surfaced in the npm registry, none of which were published by the legitimate maintainers.
Hidden in Plain Sight: How the Malware Evaded Detection
(Source: Aikido Push)
The injected malware cleverly conceals its payload by embedding it deep within the package’s distribution files—beyond the standard scroll range of typical code editors. This deceptive placement makes the code virtually invisible during routine inspection.
Urgent Action for Users of rand-user-agent
Any implementation of rand-user-agent installed from versions released after October 2024 should be treated as potentially compromised. Security teams are strongly advised to:
- Audit systems for unauthorized outbound traffic—especially attempts to connect with known command-and-control endpoints.
- Investigate unexpected alterations to environment variables, with a focus on manipulated Python PATH entries that could indicate hijacking.
Immediate forensics and containment steps can prevent deeper intrusion and lateral movement stemming from this supply chain infiltration.
