Executive Summary
A newly discovered Go-based macOS remote access trojan (RAT), identified as MiniRAT, was distributed through a compromised npm package named 'velora-dex-sdk' targeting developer environments. The malware was first observed in April 2026, though build metadata suggests development began several weeks prior. MiniRAT is designed for long-term stealth, featuring robust anti-virtual machine (VM) checks and persistence mechanisms tailored for macOS systems.
Technically, the implant leverages Go's static linking to inflate its binary footprint and obscure malicious logic. Upon execution, it performs environment profiling using native macOS utilities and establishes persistence by modifying shell configuration files and creating a LaunchAgent. It maintains a heartbeat and tasking channel via JSON files exchanged over HTTPS with its command-and-control (C2) infrastructure.
The use of legitimate software registries like npm to deliver targeted macOS malware represents a significant risk to the software supply chain. Organizations, particularly those in the technology and software development sectors, should prioritize monitoring for anomalous npm package installations and unauthorized LaunchAgent creations on macOS endpoints.