Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users in Targeted Supply Chain Attack

Cybersecurity researchers have uncovered 18 malicious npm packages distributing a cross-platform remote access trojan (RAT). These packages specifically target users of Alibaba developer tools as part of a sophisticated software supply chain attack focused on Chinese-speaking developer communities.

What happened

Security researchers detected a new campaign involving 18 malicious npm packages designed to compromise developers using Alibaba tools. Among these packages is “lib-mtop,” an unscoped npm package that mimics the name of a legitimate private package used by Alibaba. The attack delivers a cross-platform remote access trojan capable of remotely controlling infected systems. This supply chain attack targets developer environments, primarily affecting Chinese-speaking users.

Why it matters

Supply chain attacks remain a significant threat vector because they exploit trusted software dependencies, allowing attackers to infiltrate development environments and potentially downstream consumer or enterprise applications. By targeting Alibaba’s developer ecosystem, the attackers aim at a specific, high-value user base, increasing the risk of widespread compromise through a trusted package registry. The use of a cross-platform RAT enhances the attack’s reach by affecting multiple operating systems and environments.

What security teams should do

Security teams should audit their use of npm packages, especially any unscoped or suspiciously named ones such as “lib-mtop.” Reviewing the dependency tree for Alibaba developer tool environments and monitoring for unusual network activity associated with remote access trojans could help in early detection. Organizations relying on these packages should coordinate with their developers and vendors to ensure no unauthorized packages are present in their supply chain.

Key technical details

The malicious npm packages deliver a cross-platform remote access trojan, allowing attackers to execute commands remotely across affected systems. The inclusion of an unscoped package named “lib-mtop” is notable because it shares its name with a legitimate private package from Alibaba, suggesting a strategy to evade detection by blending with expected dependencies. This tactic demonstrates a nuanced approach to package masquerading within the npm registry. Details on the exact exploitation mechanism or RAT capabilities beyond cross-platform support are not provided.

Affected organizations/products

The attack targets users of Alibaba developer tools, particularly those operating within Chinese-speaking environments. The packages involved are distributed via the npm registry, affecting development environments where these dependencies are installed.

Source attribution

https://thehackernews.com/2026/08/18-malicious-npm-packages-deliver-cross.html