Popular npm Package ‘rand-user-agent’ Compromised in Supply Chain Attack

The widely used npm package rand-user-agent, known for generating random browser user-agent strings, was compromised in a supply chain attack. Malicious versions (1.0.110, 2.0.83, and 2.0.84) were published to the npm registry, containing obfuscated code that installed a Remote Access Trojan (RAT). This malware established a connection to a command-and-control server, enabling attackers to execute shell commands, upload files, and harvest system information. The malicious code was absent from the project’s GitHub repository, indicating a targeted attack on the npm distribution channel. Although the compromised versions have been removed, affected users are advised to conduct thorough system scans, as simply downgrading the package does not eliminate the RAT.