Supply Chain Attacks Targeting Research and Alibaba Ecosystems

In July 2026, two significant software supply chain campaigns emerged targeting niche developer communities. The first involved a hijacked maintainer account for the PyPI package 'mrmustard', used to publish version 0.7.4 containing a sophisticated credential stealer. This malware specifically targeted High-Performance Computing (HPC) environments by harvesting SLURM job queues and GPU inventories alongside cloud provider secrets.

Simultaneously, a separate cluster of 18 malicious npm packages was identified targeting Alibaba Group's internal R&D infrastructure. This campaign used 'dependency confusion' tactics—impersonating private @ali-scoped packages—to deliver a cross-platform Remote Access Trojan (RAT). Both campaigns demonstrate high technical maturity, using multi-stage loading, sandbox evasion, and advanced persistence mechanisms like Python .pth file hooks that survive package uninstallation.

These attacks highlight a critical shift toward industrial espionage and targeted intelligence collection within specialized research and enterprise ecosystems. Organizations must prioritize provenance verification and monitor for unauthorized publishing activities that lack corresponding version control history.