Executive Summary
A sophisticated Linux Remote Access Trojan (RAT) named MYRA was discovered being distributed through the npm package 'apintergrationpost' (versions 4.0.1 - 4.0.6), published by the user 'kimijohn01'. While the package metadata and README claim the tool is intended for authorized red team exercises and EDR validation, its capabilities include a compiled native C rootkit, interactive PTY shells, and live screen capture. The malware authors demonstrate high technical proficiency, utilizing multiple advanced evasion techniques typical of persistent threats.
Technically, the malware executes via npm lifecycle scripts to compile native binaries (e.g., libcache.so) that hook system calls to hide files and processes. It establishes triple persistence through LD_PRELOAD hijacking, cron jobs, and profile.d login hooks. Furthermore, it supports fileless execution via the memfd_create syscall, allowing the RAT to run entirely from memory while masquerading as a legitimate systemd-userdbd service. The C2 infrastructure defaults to RFC 1918 address space, suggesting a targeted lab or internal network focus.
This campaign highlights the ongoing risk of software supply chain attacks where legitimate-looking packages serve as delivery vehicles for high-capability malware. Organizations should monitor for the specified technical indicators and consider blocking the 'apintergrationpost' package across their development environments and CI/CD pipelines.