Researchers uncovered 18 malicious npm packages designed to deliver a cross-platform remote access trojan to users of Alibaba development tools. The attack represents a deliberate supply chain compromise targeting Chinese-speaking developers.

The primary infection vector exploits name confusion. One malicious package, "lib-mtop," mimics the legitimate private Alibaba package of the same name. Developers unfamiliar with Alibaba's internal package naming conventions may install the public impostor instead of the authentic private dependency. Once installed, the RAT grants attackers remote command execution capabilities across Windows, Linux, and macOS systems.

The 18 packages function as delivery mechanisms for the same malicious payload. This volume indicates the threat actors conducted systematic reconnaissance of npm's public registry to identify Alibaba tools and their dependencies. The attackers then registered packages with identical or near-identical names to legitimate libraries that Alibaba developers commonly import.

Supply chain attacks targeting npm remain persistent threats. The platform hosts over 2 million packages, and typosquatting remains difficult to prevent at scale. Package maintainers lack mandatory verification requirements, and developers frequently install dependencies without auditing their origin.

Organizations using Alibaba development tools face immediate risk. Compromised systems allow attackers to steal credentials, intellectual property, and source code. The cross-platform nature means the threat spans development environments regardless of operating system.

npm responded by removing the malicious packages from its registry. However, the packages remained accessible for an undetermined period before discovery and removal. Developers who installed these packages during the active window should audit their systems for unauthorized access and credential compromise.

Mitigation requires immediate action. Teams should verify all npm dependencies against official Alibaba repositories and documentation. Organizations should implement software composition analysis tools to detect typosquatted packages. npm account credentials linked to affected systems require rotation. Network monitoring should flag suspicious out