A sophisticated cross-platform remote access trojan (RAT) was delivered via malicious npm packages impersonating Alibaba's private packages. The RAT is capable of command execution, file transfer, host reconnaissance, and lateral movement, with persistence mechanisms that inject malicious code into enterprise collaboration apps.