Alibaba npm Supply Chain Attack: Cross-Platform RAT

**Executive Summary:** The report describes a sophisticated npm supply‑chain campaign that impersonated Alibaba private packages to distribute a modular, cross‑platform Remote Access Trojan (RAT) affecting Windows, macOS, and Linux developer environments; the malicious packages fetched remote configuration from GitHub to enable hidden payloads and persistence, established encrypted reverse TCP tunnels, and left indicators such as an "INJECTMARKER" and modified app.asar — researchers recommend removing affected packages, rotating credentials, inspecting for IoCs, and strengthening dependency verification and monitoring.