
In early May 2025, the widely used npm package ‘rand-user-agent’ found itself at the center of a sophisticated supply chain attack, affecting a core component used in web scraping applications. This JavaScript library, designed to generate random user-agent strings, was discovered with embedded malicious code that facilitated remote system access. The package’s popularity, evidenced by 45,000 weekly downloads, made the










