Covert npm malware campaign targets Alibaba developers

// 2h agoSECURITY INCIDENT

Covert npm malware campaign targets Alibaba developers

Security researchers uncovered a covert npm supply chain campaign targeting developers at Alibaba Group. The attack splits a malicious loader across benign packages to deploy a Remote Access Trojan (RAT) that poisons AI tool skills and propagates laterally via DingTalk.

// ANALYSIS

Supply chain threats are evolving past traditional credential theft to directly exploit modern AI developer tools and enterprise chat software.

* **AI Tool Skill Poisoning:** Tampering with AI assistant and agent skill configurations creates a novel, highly persistent vector in AI-augmented developer environments.

* **Split Loader Evasion:** Fragmenting malicious logic across separate, harmless-looking npm packages successfully circumvents static analysis and dependency scanners.

* **Lateral Movement via DingTalk:** Utilizing enterprise collaboration tools like DingTalk allows the Trojan to automatically propagate through internal corporate networks.

// TAGS

npmsecuritymalwarealibabasupply-chainratcybersecurity

DISCOVERED

2h ago

2026-07-28

PUBLISHED

2h ago

2026-07-28

RELEVANCE

8/ 10

AUTHOR

SocketSecurity

// KEEP READING

More AI developer news from the feed

EXPLORE FULL FEED

UPDATE30m ago

Mintlify editor loads pages 9.5x faster

Mintlify has introduced a major performance update to its documentation platform, enabling its editor to load pages 9.5x faster than before. The enhancement aims to reduce latency and friction for developers writing, editing, and managing technical documentation and API reference pages.

NEWS54m ago

David Ha runs K3 locally on M5 Max

AI researcher David Ha (@hardmaru) shared an experiment running the massive K3 language model locally on Apple's M5 Max chip. Operating at a throughput of approximately 0.3 tokens per second, the test demonstrates the capability of high-capacity Apple Silicon unified memory to host huge models, even if the current performance is exceptionally slow.

OPEN SOURCE1h ago

OpenAI open-sources Codex Security CLI

OpenAI has open-sourced Codex Security CLI, a tool designed to help developers discover, validate, and remediate vulnerabilities directly within their local development environment and CI/CD pipelines. By combining local context analysis with AI threat modeling, Codex Security CLI allows engineering teams to scan local repositories, automate security checks in workflows like GitHub Actions, and track security findings over time.