SUPPLY CHAIN ATTACK HITS NPM PACKAGE WITH 45,000 WEEKLY DOWNLOADS

Summary from the TLDR InfoSec newsletter

rand-user-agent, an npm package, was compromised in a supply chain attack that caused it to inject obfuscated code that activates a remote access trojan (RAT) on users' systems. Aikido detected the compromise on May 5, when its malware analysis flagged version 1.0.110. Researchers found obfuscated code hidden in 'dist/index.js', visible only by scrolling horizontally in the npm site's source view.