RATatouille: A Malicious Recipe Hidden in rand-user-agent (Supply Chain Compromise)

The open-source software supply chain was compromised via the popular rand-user-agent library, which developers commonly use to rotate HTTP headers and spoof user agent strings. Threat actors successfully injected a malicious payload dubbed "RATatouille" into the package repository. When an application installs or updates this package, the hidden recipe executes, establishing an unauthenticated Remote Access Trojan on the target server or endpoint. Because user-agent randomization tools are frequently used in automated data scraping, security testing, and web crawling infrastructure, this compromise directly threatens production automation environments, granting adversaries a persistent backdoor into internal enterprise networks.Development teams must immediately update or replace the rand-user-agent library within their applications, verifying the integrity of their package manifests against pristine public repository records. Security teams should scan server environments for unauthorized outbound connections originating from web automation scripts and deploy rigorous software supply chain security tools to detect unauthorized code changes within third-party dependencies.If you need expert assistance in identifying compromised packages, securing your CI/CD pipelines, or conducting an emergency supply chain audit, contact Cyberlinx today to protect your development environment.