Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers

Threat actors distributed malicious npm packages mimicking Alibaba dev tools, delivering a cross-platform RAT that went undetected for three months. The multi-stage payload enables data exfiltration, command execution, and lateral movement targeting Alibaba developers and internal tools. Any developer who installed these packages has a compromised environment with persistent remote access.

CRITICALAdvisoryJul 29, 2026

Action required

Immediately audit npm package dependencies in your environment for malicious packages matching Alibaba tooling names. Scan all developer systems for RAT IOCs, check for suspicious outbound connections, and revoke developer credentials as precaution.

Affected products

AlibabanpmDingTalkAlilangTaobao

Linked articles

Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers

Source links

https://socket.dev/blog/npm-rat-targets-alibaba?utm_medium=feed