diff --git a/threat_intel/README.md b/threat_intel/README.md index 9f702dd..c5f40f1 100644 --- a/threat_intel/README.md +++ b/threat_intel/README.md @@ -13,6 +13,7 @@ the entries against current advisories before production use. | File | Campaign | Source | |---|---|---| | [`mastra-2026-06-17.json`](mastra-2026-06-17.json) | Mastra npm supply-chain compromise (141 packages / 141 versions across `@mastra/*` plus `create-mastra` and the `easy-day-js@1.11.22` typosquat dependency that delivered a cross-platform infostealer via postinstall) | [Socket, 2026-06-17](https://socket.dev/blog/mastra-npm-packages-compromised) | +| [`alibaba-developer-rat-2026-07-28.json`](alibaba-developer-rat-2026-07-28.json) | Cross-platform RAT campaign targeting Alibaba developers (18 npm packages: 17 package-wide matches backed by OSV all-version records, plus `fast-transform-pipeline@1.0.1`) | [Socket, 2026-07-28](https://socket.dev/blog/npm-rat-targets-alibaba) | | [`mini-shai-hulud-leoplatform-2026-06-24.json`](mini-shai-hulud-leoplatform-2026-06-24.json) | Mini Shai-Hulud / Miasma (Hades variant) LeoPlatform/RStreams wave (compromised `czirker` npm account; 26 npm packages + 1 Go module / 27 versions; "Phantom Gyp" `binding.gyp` install hook, Bun-staged infostealer, "Alright Lets See If This Works" dead-drop marker) | [Socket, 2026-06-24](https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem); [OX Security, 2026-06-24](https://www.ox.security/blog/alright-lets-see-if-this-works-shai-hulud-miasma-hades-variant-spreads-on-npm/) | | [`mini-shai-hulud.json`](mini-shai-hulud.json) | Mini/Shai-Hulud May 2026 npm and PyPI compromise (OX Security affected-package table) | Cross-checked against Fleet, Socket, Snyk, Mistral, TanStack, The Hacker News | | [`mini-shai-hulud-redhat-cloud-services.json`](mini-shai-hulud-redhat-cloud-services.json) | Mini Shai-Hulud compromise of Red Hat Cloud Services (`@redhat-cloud-services`) npm packages (32 packages / 95 versions; "Miasma: The Spreading Blight" worm marker) | [Socket, 2026-06-01](https://socket.dev/blog/mini-shai-hulud-campaign-hits-red-hat-cloud-services-npm-packages) | diff --git a/threat_intel/alibaba-developer-rat-2026-07-28.json b/threat_intel/alibaba-developer-rat-2026-07-28.json new file mode 100644 index 0000000..5900895 --- /dev/null +++ b/threat_intel/alibaba-developer-rat-2026-07-28.json @@ -0,0 +1,204 @@ +{ + "schema_version": "0.2.0", + "_comment": "Cross-platform RAT campaign targeting Alibaba developers, reported by Socket on July 28, 2026. Covers all 18 npm packages in Socket's malicious-package IOC list. Seventeen entries use an any-version match because their current OSV MAL-2026 records declare every version affected with a SEMVER range introduced at 0; fast-transform-pipeline has no current OSV record and is limited to the campaign's 1.0.1 release. Source: https://socket.dev/blog/npm-rat-targets-alibaba.", + "entries": [ + { + "id": "https-socket-dev-blog-npm-rat-targets-alibaba-npm-aone-cloud-cli", + "name": "aone-cloud-cli (Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers)", + "ecosystem": "npm", + "package": "aone-cloud-cli", + "versions": [ + "*" + ], + "severity": "critical", + "source": "https://socket.dev/blog/npm-rat-targets-alibaba" + }, + { + "id": "https-socket-dev-blog-npm-rat-targets-alibaba-npm-aone-kit", + "name": "aone-kit (Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers)", + "ecosystem": "npm", + "package": "aone-kit", + "versions": [ + "*" + ], + "severity": "critical", + "source": "https://socket.dev/blog/npm-rat-targets-alibaba" + }, + { + "id": "https-socket-dev-blog-npm-rat-targets-alibaba-npm-aone-kit-cli", + "name": "aone-kit-cli (Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers)", + "ecosystem": "npm", + "package": "aone-kit-cli", + "versions": [ + "*" + ], + "severity": "critical", + "source": "https://socket.dev/blog/npm-rat-targets-alibaba" + }, + { + "id": "https-socket-dev-blog-npm-rat-targets-alibaba-npm-aone-sandbox", + "name": "aone-sandbox (Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers)", + "ecosystem": "npm", + "package": "aone-sandbox", + "versions": [ + "*" + ], + "severity": "critical", + "source": "https://socket.dev/blog/npm-rat-targets-alibaba" + }, + { + "id": "https-socket-dev-blog-npm-rat-targets-alibaba-npm-cloud-config-fetcher", + "name": "cloud-config-fetcher (Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers)", + "ecosystem": "npm", + "package": "cloud-config-fetcher", + "versions": [ + "*" + ], + "severity": "critical", + "source": "https://socket.dev/blog/npm-rat-targets-alibaba" + }, + { + "id": "https-socket-dev-blog-npm-rat-targets-alibaba-npm-colder-cli", + "name": "colder-cli (Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers)", + "ecosystem": "npm", + "package": "colder-cli", + "versions": [ + "*" + ], + "severity": "critical", + "source": "https://socket.dev/blog/npm-rat-targets-alibaba" + }, + { + "id": "https-socket-dev-blog-npm-rat-targets-alibaba-npm-def-open-client", + "name": "def-open-client (Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers)", + "ecosystem": "npm", + "package": "def-open-client", + "versions": [ + "*" + ], + "severity": "critical", + "source": "https://socket.dev/blog/npm-rat-targets-alibaba" + }, + { + "id": "https-socket-dev-blog-npm-rat-targets-alibaba-npm-fast-transform-pipeline", + "name": "fast-transform-pipeline (Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers)", + "ecosystem": "npm", + "package": "fast-transform-pipeline", + "versions": [ + "1.0.1" + ], + "severity": "critical", + "source": "https://socket.dev/blog/npm-rat-targets-alibaba" + }, + { + "id": "https-socket-dev-blog-npm-rat-targets-alibaba-npm-feedback-ai-sdk", + "name": "feedback-ai-sdk (Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers)", + "ecosystem": "npm", + "package": "feedback-ai-sdk", + "versions": [ + "*" + ], + "severity": "critical", + "source": "https://socket.dev/blog/npm-rat-targets-alibaba" + }, + { + "id": "https-socket-dev-blog-npm-rat-targets-alibaba-npm-flight-compare-analyzer", + "name": "flight-compare-analyzer (Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers)", + "ecosystem": "npm", + "package": "flight-compare-analyzer", + "versions": [ + "*" + ], + "severity": "critical", + "source": "https://socket.dev/blog/npm-rat-targets-alibaba" + }, + { + "id": "https-socket-dev-blog-npm-rat-targets-alibaba-npm-lib-mtop", + "name": "lib-mtop (Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers)", + "ecosystem": "npm", + "package": "lib-mtop", + "versions": [ + "*" + ], + "severity": "critical", + "source": "https://socket.dev/blog/npm-rat-targets-alibaba" + }, + { + "id": "https-socket-dev-blog-npm-rat-targets-alibaba-npm-local-config-parser", + "name": "local-config-parser (Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers)", + "ecosystem": "npm", + "package": "local-config-parser", + "versions": [ + "*" + ], + "severity": "critical", + "source": "https://socket.dev/blog/npm-rat-targets-alibaba" + }, + { + "id": "https-socket-dev-blog-npm-rat-targets-alibaba-npm-lwp-web-client", + "name": "lwp-web-client (Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers)", + "ecosystem": "npm", + "package": "lwp-web-client", + "versions": [ + "*" + ], + "severity": "critical", + "source": "https://socket.dev/blog/npm-rat-targets-alibaba" + }, + { + "id": "https-socket-dev-blog-npm-rat-targets-alibaba-npm-lzd-unified-station-sdk", + "name": "lzd-unified-station-sdk (Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers)", + "ecosystem": "npm", + "package": "lzd-unified-station-sdk", + "versions": [ + "*" + ], + "severity": "critical", + "source": "https://socket.dev/blog/npm-rat-targets-alibaba" + }, + { + "id": "https-socket-dev-blog-npm-rat-targets-alibaba-npm-open-worker-cli", + "name": "open-worker-cli (Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers)", + "ecosystem": "npm", + "package": "open-worker-cli", + "versions": [ + "*" + ], + "severity": "critical", + "source": "https://socket.dev/blog/npm-rat-targets-alibaba" + }, + { + "id": "https-socket-dev-blog-npm-rat-targets-alibaba-npm-smart-config-manager", + "name": "smart-config-manager (Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers)", + "ecosystem": "npm", + "package": "smart-config-manager", + "versions": [ + "*" + ], + "severity": "critical", + "source": "https://socket.dev/blog/npm-rat-targets-alibaba" + }, + { + "id": "https-socket-dev-blog-npm-rat-targets-alibaba-npm-test-skill-zip", + "name": "test-skill-zip (Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers)", + "ecosystem": "npm", + "package": "test-skill-zip", + "versions": [ + "*" + ], + "severity": "critical", + "source": "https://socket.dev/blog/npm-rat-targets-alibaba" + }, + { + "id": "https-socket-dev-blog-npm-rat-targets-alibaba-npm-uniapi-bridge", + "name": "uniapi-bridge (Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers)", + "ecosystem": "npm", + "package": "uniapi-bridge", + "versions": [ + "*" + ], + "severity": "critical", + "source": "https://socket.dev/blog/npm-rat-targets-alibaba" + } + ] +}