Poisoned Pipeline

Poisoned Pipeline / Incidents / AS144

AS144 · 2026-08

npm RAT cluster targeting Alibaba developers

npm

Socket: distributed npm package cluster delivering a cross-platform
RAT aimed at Alibaba developers.

Mapped techniques

supply-chain campaign

T0109 · Resource Development · Publish malicious artifact

Cluster of npm packages.

T0136 · Initial Access · Brandjacking

Alibaba-developer targeting.

T0172 · Execution · Runtime backdoor

Cross-platform RAT.

Sources