Malicious npm packages impersonate Alibaba tools to deliver a cross-platform RAT with command execution, persistence, and lateral movement.