Threat Intelligence

Malicious npm Packages Target Alibaba Developer Tool Users With Hidden Remote Access Trojan

The Hacker News · 4 Aug 2026

Key Takeaway Regularly audit and verify the source of software packages used in your development pipeline, and restrict automatic installation of unverified public dependencies.

Security researchers have uncovered 18 malicious packages on the npm software repository designed to target users of Alibaba developer tools, primarily within Chinese-speaking developer communities. The attack relies on a technique known as dependency confusion, where attackers publish a public package with the same name as a private, internal one—in this case, a package called "lib-mtop" mimicking a genuine private Alibaba package.

When unsuspecting developers or automated build systems pull in these lookalike packages, malicious code is installed that deploys a cross-platform remote access trojan (RAT). This gives attackers the ability to control infected machines, potentially exposing sensitive company data, source code, and internal systems to compromise.

This incident highlights how software supply chain attacks continue to evolve, with attackers increasingly targeting the tools and package ecosystems developers rely on daily. Businesses using open-source components, even indirectly through vendors or contractors, can be exposed to risks introduced upstream in the software supply chain.

supply chain attack npm security malware remote access trojan software development

Summarised by CISO AI from The Hacker News. We link back to every original so you can read it yourself.