18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users

Cybersecurity researchers uncovered a targeted supply-chain campaign using malicious npm packages that impersonate Alibaba-scoped modules to deliver a multi-stage cross-platform RAT. The attack splits loader logic across several packages and a rule engine that fetches and executes OS-specific payloads from a domain masquerading as Alibaba, enabling persistence, credential theft, lateral movement and tampering with enterprise collaboration apps; users who installed listed packages should assume compromise and rotate credentials.