# Remote Access Trojan

A remote access trojan is malware that lets an attacker remotely control an infected computer through a command-and-control channel.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## AsyncAPI supply chain compromise: npm packages backdoored via GitHub Actions "pwn request" (July 2026)

DevFeed: [AsyncAPI supply chain compromise: npm packages backdoored via GitHub Actions "pwn request" (July 2026)](<https://devfeed.tech/articles/asyncapi-supply-chain-compromise-npm-packages-backdoored-via-github-actions-pwn-request-july-2026-12890.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/asyncapi-supply-chain-compromise-npm-packages-backdoored-via-github-actions>)

Published: 2026-07-14T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [AsyncAPI Specification](<https://devfeed.tech/topics/asyncapi.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Remote Access Trojan](<https://devfeed.tech/topics/remote-access-trojan.md>), [passwords](<https://devfeed.tech/topics/passwords.md>), [ssh](<https://devfeed.tech/topics/ssh.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>), [Cryptocurrency](<https://devfeed.tech/topics/cryptocurrency.md>)

Tags: [asyncapi-supply-chain-attack](<https://devfeed.tech/tags/asyncapi-supply-chain-attack.md>), [chainguard-asyncapi](<https://devfeed.tech/tags/chainguard-asyncapi.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [ci](<https://devfeed.tech/tags/ci.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [cryptocurrency](<https://devfeed.tech/tags/cryptocurrency.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [github-actions-pwn-request](<https://devfeed.tech/tags/github-actions-pwn-request.md>), [malicious-packages](<https://devfeed.tech/tags/malicious-packages.md>), [malware](<https://devfeed.tech/tags/malware.md>), [miasma](<https://devfeed.tech/tags/miasma.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [passwords](<https://devfeed.tech/tags/passwords.md>), [personal-access-token](<https://devfeed.tech/tags/personal-access-token.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [pull-requests](<https://devfeed.tech/tags/pull-requests.md>), [remote-access-trojan](<https://devfeed.tech/tags/remote-access-trojan.md>), [ssh](<https://devfeed.tech/tags/ssh.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [tokens](<https://devfeed.tech/tags/tokens.md>)

### AI overview

The article analyzes a July 14, 2026 supply-chain compromise in which an attacker stole a privileged GitHub personal access token through a misconfigured GitHub Actions workflow and used it to publish five backdoored versions across four AsyncAPI npm packages. The malware activates when a library is loaded by a build or CI job and steals browser passwords, SSH keys, npm and GitHub tokens, cloud credentials, and cryptocurrency wallets while maintaining command-and-control access. It also explains why Chainguard customers were protected and recommends treating affected environments as compromised and rotating credentials.

### Source excerpt

A supply chain attack compromised AsyncAPI npm packages via GitHub Actions. See how Chainguard blocked the malicious releases by design.

## @mastra npm scope takeover: 143 packages backdoored via compromised contributor account

DevFeed: [@mastra npm scope takeover: 143 packages backdoored via compromised contributor account](<https://devfeed.tech/articles/mastra-npm-scope-takeover-143-packages-backdoored-via-compromised-contributor-account-13149.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/mastra-npm-scope-takeover-143-packages-backdoored-via-compromised-contributor-account>)

Published: 2026-06-17T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [npm](<https://devfeed.tech/topics/npm.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Remote Access Trojan](<https://devfeed.tech/topics/remote-access-trojan.md>), [Cryptocurrency](<https://devfeed.tech/topics/cryptocurrency.md>), [C2](<https://devfeed.tech/topics/c2.md>)

Tags: [c2](<https://devfeed.tech/tags/c2.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-packages](<https://devfeed.tech/tags/chainguard-packages.md>), [command-and-control](<https://devfeed.tech/tags/command-and-control.md>), [crypto](<https://devfeed.tech/tags/crypto.md>), [malware](<https://devfeed.tech/tags/malware.md>), [mastra](<https://devfeed.tech/tags/mastra.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-takeover](<https://devfeed.tech/tags/npm-takeover.md>), [packages](<https://devfeed.tech/tags/packages.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [remote-access](<https://devfeed.tech/tags/remote-access.md>), [remote-access-trojan](<https://devfeed.tech/tags/remote-access-trojan.md>), [secure-packages](<https://devfeed.tech/tags/secure-packages.md>), [software-packages](<https://devfeed.tech/tags/software-packages.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [tls](<https://devfeed.tech/tags/tls.md>)

### AI overview

The article reports that an attacker used a compromised former contributor account to republish all 143 packages in the @mastra npm scope on June 17, 2026. The malicious versions could disable TLS verification, download a cryptocurrency wallet stealer and remote access trojan, and establish command-and-control access. It recommends auditing dependency trees and lockfiles and rotating credentials on affected hosts.

### Source excerpt

A supply chain attack compromised all 143 @mastra packages. Chainguard customers stayed protected through malware blocking and source-built libraries.

## BTMOB: A stealthy RAT burrowing deep into Android devices

DevFeed: [BTMOB: A stealthy RAT burrowing deep into Android devices](<https://devfeed.tech/articles/btmob-a-stealthy-rat-burrowing-deep-into-android-devices-8390.md>)

Original publisher: [Read original article](<https://www.welivesecurity.com/en/malware/btmob-stealthy-rat-burrowing-deep-android-devices/>)

Author: Daniel Cunha Barbosa

Published: 2026-05-26T08:50:00Z

Content type: article

Language: en

Sources: [WeLiveSecurity](<https://devfeed.tech/sources/welivesecurity.md>)

Topics: [ransomware](<https://devfeed.tech/topics/ransomware.md>), [Remote Access Trojan](<https://devfeed.tech/topics/remote-access-trojan.md>), [Android](<https://devfeed.tech/topics/android.md>), [Social engineering](<https://devfeed.tech/topics/social-engineering.md>), [APK](<https://devfeed.tech/topics/apk.md>), [Tooling](<https://devfeed.tech/topics/tooling.md>), [Accessibility](<https://devfeed.tech/topics/accessibility.md>)

Tags: [android](<https://devfeed.tech/tags/android.md>), [code](<https://devfeed.tech/tags/code.md>), [malware](<https://devfeed.tech/tags/malware.md>), [phishing](<https://devfeed.tech/tags/phishing.md>), [remote-access-trojan](<https://devfeed.tech/tags/remote-access-trojan.md>), [social-engineering](<https://devfeed.tech/tags/social-engineering.md>), [tool](<https://devfeed.tech/tags/tool.md>)

### AI overview

BTMOB is an Android remote access trojan that spreads through phishing websites, fake app stores, and malicious APKs. It can exfiltrate sensitive data, capture screenshots, record device activity, and enable remote control. Its APK builder and malware-as-a-service model make customized campaigns easier to launch.

### Source excerpt

The malware pairs remote access capabilities with ready-made campaign tools, lowering the barrier for full device compromise

## Malicious axios versions published to npm: Chainguard customers protected

DevFeed: [Malicious axios versions published to npm: Chainguard customers protected](<https://devfeed.tech/articles/malicious-axios-versions-published-to-npm-chainguard-customers-protected-13145.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/malicious-axios-versions-published-to-npm-chainguard-customers-protected>)

Published: 2026-03-31T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [axios](<https://devfeed.tech/topics/axios.md>), [npm](<https://devfeed.tech/topics/npm.md>), [Remote Access Trojan](<https://devfeed.tech/topics/remote-access-trojan.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [payload](<https://devfeed.tech/topics/payload.md>), [Single-page application (SPA)](<https://devfeed.tech/topics/spa.md>), [Filesystems](<https://devfeed.tech/topics/filesystems.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [Script](<https://devfeed.tech/topics/script.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [macOS](<https://devfeed.tech/topics/macos.md>)

Tags: [axios](<https://devfeed.tech/tags/axios.md>), [axios-attack](<https://devfeed.tech/tags/axios-attack.md>), [axios-npm-attack](<https://devfeed.tech/tags/axios-npm-attack.md>), [axios-supply-chain-attack](<https://devfeed.tech/tags/axios-supply-chain-attack.md>), [c2](<https://devfeed.tech/tags/c2.md>), [chainguard-actions](<https://devfeed.tech/tags/chainguard-actions.md>), [chainguard-axios](<https://devfeed.tech/tags/chainguard-axios.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-npm-libraries](<https://devfeed.tech/tags/chainguard-npm-libraries.md>), [dependency](<https://devfeed.tech/tags/dependency.md>), [files](<https://devfeed.tech/tags/files.md>), [http](<https://devfeed.tech/tags/http.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [linux](<https://devfeed.tech/tags/linux.md>), [macos](<https://devfeed.tech/tags/macos.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [payload](<https://devfeed.tech/tags/payload.md>), [remote-access-trojan](<https://devfeed.tech/tags/remote-access-trojan.md>), [script](<https://devfeed.tech/tags/script.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

The article reports that two malicious axios versions were published to npm with a hidden dependency that deployed a cross-platform remote access trojan on macOS, Windows, and Linux. It explains the compromised maintainer account, post-install execution, command-and-control communication, payload delivery, and recommended auditing and remediation steps. Chainguard customers were protected by package-blocking and source-verification controls.

### Source excerpt

Malicious axios versions on npm delivered a RAT via a hidden dependency. Chainguard customers were protected by blocking unsafe packages and verifying source.

## Compromised axios npm package delivers cross-platform RAT

DevFeed: [Compromised axios npm package delivers cross-platform RAT](<https://devfeed.tech/articles/compromised-axios-npm-package-delivers-cross-platform-rat-8274.md>)

Original publisher: [Read original article](<https://securitylabs.datadoghq.com/articles/axios-npm-supply-chain-compromise/>)

Author: Christophe Tafani-Dereeper

Published: 2026-03-31T00:00:00Z

Content type: article

Language: en

Sources: [Datadog Security Labs](<https://devfeed.tech/sources/datadog-security-labs.md>)

Topics: [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [Remote Access Trojan](<https://devfeed.tech/topics/remote-access-trojan.md>), [backdoor](<https://devfeed.tech/topics/backdoor.md>), [account takeover](<https://devfeed.tech/topics/account-takeover.md>), [payload](<https://devfeed.tech/topics/payload.md>), [npm](<https://devfeed.tech/topics/npm.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [Windows](<https://devfeed.tech/topics/windows.md>)

Tags: [account-takeover](<https://devfeed.tech/tags/account-takeover.md>), [backdoor](<https://devfeed.tech/tags/backdoor.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [linux](<https://devfeed.tech/tags/linux.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [payload](<https://devfeed.tech/tags/payload.md>), [remote-access-trojan](<https://devfeed.tech/tags/remote-access-trojan.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

The article analyzes a March 31, 2026 supply-chain compromise in which an attacker hijacked an axios npm maintainer account and published two malicious releases. The releases added a typosquatted dependency that installed a cross-platform remote access trojan, though bugs limited the Windows and Linux payloads. The compromise lasted about three hours before npm removed the packages.

### Source excerpt

An attacker hijacked an axios maintainer's npm account to publish malicious releases that deliver a cross-platform RAT.