Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers

Reported 29 Jul 2026 by otx · Severity: medium

Unknown threat actors distributed malicious downloader functionality across multiple npm packages targeting users of Alibaba tools. The campaign used typosquatting tactics by creating unscoped packages impersonating private packages from Alibaba's @ali scope. Malicious functional