npm Supply Chain RAT — Alibaba/DingTalk targeting

Ankit Mehta@Secvyn

•updated Aug 5, 2026•5•1•7

This rule monitors file events to detect the presence of known malicious npm packages identified in a supply chain attack. It specifically checks for files created or modified within 'node_modules' directories that match a predefined list of malicious package names.