MYRA Linux RAT via apintergrationpost

SafeDep documented MYRA, a full Linux RAT distributed through the npm
package apintergrationpost (deliberate misspelling). Not a hijack of a
popular library — a purpose-built RAT on the public registry.

Mapped techniques

T0109 Publish malicious artifact
T0129 Typosquatting
T0172 Runtime backdoor

supply-chain purpose-built npm rat

T0109 · Resource Development · Publish malicious artifact

apintergrationpost on npm.

T0129 · Initial Access · Typosquatting

Misspelled integration as the lure.

T0172 · Execution · Runtime backdoor

Full Linux RAT.

Sources

https://safedep.io/malicious-apintergrationpost-npm-myra-rat