18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users

A software supply chain attack has been uncovered involving 18 malicious npm packages that impersonate legitimate Alibaba-scoped packages, targeting Chinese-speaking developers. The packages deliver a cross-platform remote access trojan (RAT) through a multi-stage payload delivery mechanism that uses a rule engine and vm module to execute OS-specific malicious actions. On Windows, it trojanizes enterprise apps like Alilang; on Linux, it runs a memory-resident binary; and on macOS, it installs a persistent background script. The final payload enables command execution, file exfiltration, host reconnaissance, and lateral movement, suggesting industrial espionage as the likely motive.

AI-extracted · verify before operational use