18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users

Summary: Researchers at Socket found 18 malicious npm packages, including "lib-mtop" and four others published by the maintainer account "ch4ce," that impersonate private @ali-scoped Alibaba packages and deliver a cross-platform RAT through a split dependency tree. A low-layer package fetches a rule engine configuration from GitHub, uses the vm module to download an OS-specific payload from a domain masquerading as Alibaba, and the final backdoor persists by injecting code into DingTalk, Wukong, and Qoder.
Why it matters: The loader is spread across multiple packages in one dependency tree, so no single package looks malicious on its own, and the final payload can move laterally and persist inside the collaboration tools your developers already run. Socket's Karlo Zanki said the goal appears to be industrial espionage, and the targeted nature of the campaign makes its impact hard to evaluate despite low download counts.

Read the original at The Hacker News ↗

Topics: Supply Chain & AppSec
Related: Kitesurf is now open source Cyber Risks · Nov 13, 2026
Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026
ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026