Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers

A sophisticated and targeted campaign has been uncovered involving malicious npm packages designed to deliver a cross-platform Remote Access Trojan (RAT) to developers associated with Alibaba Group. The threat actors distributed malicious functionality across multiple seemingly benign packages, leveraging impersonation of private @ali-scoped packages to increase legitimacy. The final payload enables command execution, data exfiltration, lateral movement via DingTalk, and persistence through AI-tool poisoning, indicating a focus on industrial espionage. The infrastructure and code suggest operation by a Chinese-speaking actor, with the campaign remaining active for over three months.

AI-extracted · verify before operational use