Minirat’s Stealth Supply Chain Attack Targets macOS Developers

Iru researchers discovered Minirat, a Go-written macOS RAT distributed through a compromised npm package (velora-dex-sdk) targeting developer endpoints; the malware detects sandboxes, ensures single-instance execution, establishes persistence via .zshrc and a LaunchAgent, stores AES-encrypted C2 lists (key disclosed), and supports directory exfiltration, remote command execution, and payload retrieval via JSON channels.