Malicious npm dependency chain installs RAT on Alibaba tool users
Cybersecurity researchers have identified 18 malicious npm packages aimed at Chinese-speaking developers using Alibaba tools. The targeted software supply chain campaign delivers a cross-platform remote access trojan with command execution, file transfer, reconnaissance, payload staging, persistence, and lateral movement capabilities.
One package, lib-mtop, shares its name with a private Alibaba package under the @ali scope. It was initially published without functionality in November 2023, but versions 1.0.1, 1.0.2, and 1.0.3 added a loader in March and April. The loader uses curl to fetch remote JavaScript and execute it.
A loader distributed across dependencies
Socket found that the campaign divides malicious functionality among several packages in the same dependency tree. Top-layer packages impersonate private @ali modules and act as decoys, while smart-config-manager forms a middle-layer bridge to packages containing the loader logic. Ten lure packages were found to depend on that bridge.
The structure demonstrates how trusted package names conceal supply chain attacks can let malicious components blend into familiar development workflows while distributing suspicious behavior across packages. A low-layer component contacts a GitHub repository for a rule-engine configuration, executes a payload, and reaches a remote server for secondary malware.
The rule engine uses Node.js's vm module to select the final download for the victim's operating system. Its delivery domain masquerades as Alibaba infrastructure to reduce suspicion.
Different actions on Windows, Linux, and macOS
On Windows, the malware terminates the Alilang enterprise security, VPN, and productivity application, then replaces its core code with a trojanized version. On Linux, it downloads a binary into /tmp, launches it as a detached process, and deletes the on-disk file after loading it into memory.
On macOS, the attack inserts a background script into ~/.zshrc and establishes a Launch Agent that runs every 10 minutes. The final backdoor can also inject malicious code into enterprise collaboration applications including DingTalk, Wukong, and Qoder to maintain access and support lateral spread.
Targeting and response
The campaign's operator remains unknown. Chinese-language source-code comments and GitHub commits using the UTC+08:00 offset suggest a Chinese-speaking actor targeting Chinese-speaking developers associated with Alibaba Group tools. Socket researcher Karlo Zanki said the apparent objective is industrial espionage, although the targeted nature of the operation makes its impact difficult to measure from download counts.
Affected packages include lib-mtop, aone-kit, aone-kit-cli, aone-sandbox, local-config-parser, smart-config-manager, cloud-config-fetcher, fast-transform-pipeline, aone-cloud-cli, colder-cli, def-open-client, feedback-ai-sdk, flight-compare-analyzer, lwp-web-client, lzd-unified-station-sdk, open-worker-cli, test-skill-zip, and uniapi-bridge.
Organizations that installed any listed package should assume compromise, isolate and inspect developer systems, rotate sensitive credentials from a clean machine, and audit dependency trees, persistence locations, and collaboration applications for suspicious changes.