The rand-user-agent npm Supply Chain Attack

What happened

Attackers published three bad versions of rand-user-agent to npm in early May 2025, and the versions carried a remote access trojan. BleepingComputer reports that the attackers used an outdated automation token that had no two-factor protection. The malicious code was not in the GitHub repository. The developer, WebScrapingAPI, states that there was no breach of its source repository, build pipeline or corporate network.

The sources give different detection dates, from 5 May to 9 May 2025. Aikido, which found the problem, reports detection on 6 May 2025. The last clean version, 2.0.82, was seven months old.

Aikido reports that the code in dist/index.js was obfuscated and hidden off the edge of the screen in the npm file viewer. A package that only builds strings gained code for socket networking, folder creation and remote command execution.

The code makes a hidden folder at ~/.node_modules and extends module.paths so it can load its own copies of axios and socket.io-client. It then connects to the attacker server and sends the host name, user name, operating system and a UUID. The server can send commands. Aikido lists directory commands (cd, ss_dir, ss_fcd), file upload commands (ss_upf, ss_upd), a stop command (ss_stop) and arbitrary shell commands.

On Windows, the code puts %LOCALAPPDATA%\Programs\Python\Python3127 at the front of the system PATH. A program that sits there can replace Python commands without any warning. SecurityWeek calls this backdoor "Python3127 PATH Hijack".

Affected versions

• rand-user-agent 2.0.83 and 2.0.84.
• rand-user-agent 1.0.110.
• Clean: 2.0.82. Malicious versions were removed from npm.

BleepingComputer warns that a downgrade does not remove the trojan. A machine that ran a bad version needs a full scan.

Indicators of compromise

• Command and control: 85.239.62[.]36. Socket.io channel on port 3306 and file upload at port 27017 path /u/f.
• A hidden folder ~/.node_modules/ that holds axios and socket.io-client.
• On Windows, a PATH entry for %LOCALAPPDATA%\Programs\Python\Python3127 and that folder on disk.
• Obfuscated code in dist/index.js of the package.
• RAT command names: ss_dir, ss_fcd, ss_upf, ss_upd, ss_stop.

How to check

Look for the bad versions in your projects, then look for the traces on the machine.

npm ls --all rand-user-agent
grep -n 'rand-user-agent' package-lock.json
ls -la ~/.node_modules 2>/dev/null
lsof -nP -i | grep '85.239.62.36'

On Windows, run $env:PATH -split ';' | Select-String Python3127 in PowerShell and look in the Python folder under your local app data. Search firewall logs for the command server address too.

What to do now

1. Pin rand-user-agent to 2.0.82 or a later clean release, or move to a maintained fork.
2. On any machine that installed a bad version, remove ~/.node_modules and the PATH change. Do a full scan, since a downgrade does not clean the machine.
3. Rotate credentials that the machine held. The trojan could run any command and upload files.
4. Block the command server address and search logs for past connections.
5. Use automation tokens with two-factor protection and retire tokens that you no longer need.
6. Vigilance compares a new package version with the one you trust and reports the file that gained a new capability. Here, dist/index.js gained socket networking and command execution in a package that only builds strings.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 49

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

CHANGED    dist/index.js
           It now downloads from the internet and runs other programs. It did not before.

Sources

1. aikido.dev/blog/catching-a-rat-remote-access-trojian-rand-user-agent-supply-chain-compromise
2. bleepingcomputer.com/news/security/supply-chain-attack-hits-npm-package-with-45-000-weekly-downloads/
3. securityweek.com/popular-scraping-tools-npm-package-compromised-in-supply-chain-attack/