Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers

Unknown actors published malicious npm packages impersonating Alibaba's private `@ali` packages to deliver a multi-stage loader that fetches and executes staged payloads from attacker-controlled GitHub and OSS hosts, culminating in a targeted cross-platform Remote Access Trojan (aone-cli) capable of reconnaissance, data exfiltration, command execution, persistence (including AI-tool poisoning), and lateral movement via DingTalk; the report includes IoCs, C2 domains, hashes, and remediation guidance for affected developer environments.