Researchers found malicious npm packages that impersonate Alibaba private packages and deliver a cross-platform RAT against Chinese-speaking developers in a targeted supply chain campaign. The attack uses layered dependencies, Alibaba-themed infrastructure, and OS-specific payloads to enable persistence, espionage, and lateral movement. #lib-mtop #aone-kit #aone-kit-cli #aone-sandbox #local-config-parser #smart-config-manager #Alibaba
Keypoints
- Malicious npm packages impersonated Alibaba private packages to target developer environments.
- The campaign used split loader logic across multiple dependency layers.
- The final payload delivered a cross-platform RAT with strong persistence and execution capabilities.
- Windows, Linux, and macOS systems were handled with different malicious actions.
- A separate poisoned mrmustard release stole SSH keys, AWS credentials, and Kubernetes configs.
Read More: https://thehackernews.com/2026/08/18-malicious-npm-packages-deliver-cross.html