🟠 High  |  Source: The Hacker News

Eighteen malicious npm packages have been discovered targeting developers who use Alibaba’s internal tooling, delivering a cross-platform remote access trojan (RAT) capable of compromising Windows, macOS, and Linux systems. The attack uses typosquatting and package name confusion — mimicking a private Alibaba package called ’lib-mtop’ — to deceive developers into installing malware. This represents a targeted software supply chain attack aimed primarily at Chinese-speaking developer environments.

Security Architect’s Take: Audit your organisation’s npm dependency trees immediately for any Alibaba-related packages, particularly ’lib-mtop’ and similar unscoped packages that shadow known private registries. Enforce the use of a private npm registry with an allowlist policy and configure .npmrc to scope internal packages, preventing resolution of unscoped public packages that could shadow internal dependencies.

Original advisory: 18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users