Multi-stage npm supply chain campaign distributing a remote access trojan through 18 malicious packages that impersonate Alibaba Group private @ali scope internal packages. The packages were published across multiple npm maintainer accounts on April 27-28, 2026 and remained undetected for approximately three months, using top-layer lure packages that pull staged loaders from attacker-controlled Alibaba Cloud OSS buckets. The final-stage payload provides command execution, arbitrary file upload and download, host reconnaissance, payload staging, an encrypted reverse TCP proxy, persistence through code injection into the host application, and DingTalk-based lateral movement.