A covert npm campaign targeting @alibabagroup developers split its loader across benign-looking packages. Combined, they deployed a cross-platform RAT that poisons AI tool skills for persistence and spreads laterally through DingTalk. https://socket.dev/blog/npm-rat-targets-alibaba