A cluster of malicious npm packages has been used to deliver a cross-platform remote access trojan against developers who use Alibaba-related tools.
The campaign hides its harmful code across several packages, making each part look ordinary when viewed on its own.
The attack relies on package names that imitate private Alibaba packages and adds malicious dependencies during installation.
This approach can expose developer workstations, source code, credentials, and internal collaboration environments to remote control.
Researchers at Socket.dev identified the activity after examining the lib-mtop package, which had received new versions after years of little activity.
Socket.dev said in a report shared with Cyber Security News (CSN) that the operation appears narrowly focused rather than widely distributed.
Although the malicious packages recorded limited downloads, the RAT’s ability to collect data, run commands, and move through DingTalk-related tools creates a potentially serious espionage risk for affected organizations.
Malicious npm Packages Deploy Cross-Platform RAT
The attackers used a layered dependency chain in which top-level lure packages copied the names of private packages under Alibaba’s ali scope.
When a developer installed one of these lookalikes, additional dependencies supplied the downloader and rule-processing components.
This technique reflects the wider risk seen in recent npm supply chain attacks, where a seemingly harmless dependency can become the entry point for a larger compromise.
The packages were published through different maintainer accounts, helping conceal their shared purpose.
The dependency chain fetched a configuration file from an attacker-controlled GitHub repository and saved it locally as .cloud-preferences.json.
Anatomy of a multi-stage supply-chain attack (Source – Socket.dev)
A package named local-config-parser then evaluated the rules inside that file, allowing hidden code to run on the victim’s machine.
The malicious rule abused a known escape from Node.js virtual-machine isolation. It accessed the host process, recovered Node’s module-loading functions, and downloaded another payload from infrastructure hosted in Alibaba Cloud, likely to make malicious traffic appear less unusual.
The next stage profiles the host and selects a payload for macOS, Windows, or Linux.
On macOS, it adds persistence through .zshrc and a Launch Agent; on Windows, it replaces the app.asar file of the Alilang security application; on Linux, it runs a temporary binary in the background.
RAT Capabilities and Response
The final aone-cli payload is a remote access trojan built for systems connected to Alibaba’s internal development ecosystem.
It can execute shell commands, upload and download files, collect host details, stage additional payloads, and create an encrypted reverse TCP proxy.
Its focus on DingTalk, Wukong, and Qoder enterprise tools is particularly concerning.
The malware can alter Python scripts in application .skills directories so that a hidden script runs later, offering a route for persistence and lateral movement across developer environments.
This makes the campaign comparable to other developer-focused RAT malware campaigns, but its package impersonation and Alibaba-specific tooling suggest a more targeted objective.
The Chinese-language comments and China Standard Time commit metadata may point to a Chinese-speaking operator, though they do not establish attribution.
Teams that installed any listed package should treat the affected environment as compromised and begin remediation from a clean device.
They should preserve forensic evidence where possible, remove the packages, rotate exposed development and cloud secrets, and inspect Python files for the INJECTMARKER value.
Security teams should also identify every developer workstation that installed the affected dependencies, review suspicious DingTalk activity, and monitor for connections to the listed command-and-control infrastructure.
Reviewing requests that use forged DingTalk Origin and Referer headers can help uncover communications tied to this threat.
Organizations can reduce similar exposure by reviewing dependency changes before deployment and limiting package-install permissions in sensitive build environments.
Coverage of malicious package delivery methods and npm registry compromise incidents also underscores why developers must treat unexpected dependency updates as a security event.
Indicators of Compromise (IoCs):-
TypeIndicatorDescriptionMalicious npm packagelib-mtopMalicious downloader packageMalicious npm packageaone-kitTop-layer lure packageMalicious npm packageaone-kit-cliTop-layer lure packageMalicious npm packageaone-sandboxTop-layer lure packageMalicious npm packagelocal-config-parserRule parser with malicious auto-initialization logicMalicious npm packagesmart-config-managerMiddle-layer dependency packageMalicious npm packagecloud-config-fetcherConfiguration-fetching dependencyMalicious npm packagefast-transform-pipelineTesting and delivery packageMalicious npm packageaone-cloud-cliTop-layer lure packageMalicious npm packagecolder-cliTop-layer lure packageMalicious npm packagedef-open-clientTop-layer lure packageMalicious npm packagefeedback-ai-sdkTop-layer lure packageMalicious npm packageflight-compare-analyzerTop-layer lure packageMalicious npm packagelwp-web-clientTop-layer lure packageMalicious npm packagelzd-unified-station-sdkTop-layer lure packageMalicious npm packageopen-worker-cliTop-layer lure packageMalicious npm packagetest-skill-zipTop-layer lure packageMalicious npm packageuniapi-bridgeTop-layer lure packageGitHub accountsmi1e2uMalicious maintainer accountGitHub repositoryfast-transform-pipelineTesting repositoryGitHub repositorysmart-config-managerRepository containing malicious configuration rulesSHA-25684a6ccaaab1596139d28e822f40cc99c68d337d4c81d1c6d9692c1d6bb22e4afpreferences.json configuration fileSHA-2566044974c633b3a319c31bb32110411520c425e89722a64806528553227e7a50asetting.js third-stage loaderSHA-2560910ecfa049738ef3f2540855341a380df89224ff71da94b4c21689fd66f62e3aone-cli.js deployed on macOSSHA-256b8b81af76163bdcc5b4f7d8fe6795f164991f8a62678c971db031b9e90a27813aone-cli deployed on LinuxSHA-256ef9a1896eeaae929800eade768276e2240ef252d26d0d96c1950a1a5e1aadb34aone-cli.zip deployed on WindowsSHA-256e5d8350f1540fe91145dc262c455bca7748ad97dafb2d9facd5adebed9f66d2daone-cli-deps.tar.gz older payload versionSHA-25641957bd0ba2d9c07af2e069f10780fdf6b2102c065bebe0db2136dfe07d67a28crypto.js third-stage loaderSHA-25633b58598eb317553942e27545982d4c25ce6120eae10e42393746eb0e02ecae9aone-kit-update Linux payloadC2 domainxemzqli2vu.ai-app.pubPrimary command-and-control domainC2 domaindiamond-cli-znsxphqell.cn-shanghai.fcapp.runReverse-proxy WebSocket command-and-control endpointPayload URLhxxps://aone-cli-next.oss-cn-beijing.aliyuncs.com/config/setting.jsThird-stage loader deliveryPayload URLhxxps://aone-ai-cli.oss-cn-beijing.aliyuncs.com/app/release/aone-cli.jsmacOS payload deliveryPayload URLhxxps://aone-ai-cli.oss-cn-beijing.aliyuncs.com/app/release/aone-cli-deps.tar.gzPayload dependency archivePayload URLhxxps://aone-ai-cli.oss-cn-beijing.aliyuncs.com/app/release/aone-cliLinux payload deliveryPayload URLhxxps://aone-ai-cli.oss-cn-beijing.aliyuncs.com/app/release/aone-cli.zipWindows payload deliveryPayload URLhxxps://aone-kit.oss-cn-beijing.aliyuncs.com/plugins/crypto.jslib-mtop payload deliveryPayload URLhxxps://aone-kit.oss-cn-beijing.aliyuncs.com/aone-kit-update/aone-kit.jsLinux payload deliveryPayload URLhxxps://aone-kit.oss-cn-beijing.aliyuncs.com/aone-kit-update/app.asarTrojanized Windows application archiveConfiguration indicatorINJECTMARKERMarker used to identify injected Python codeEnvironment variableROBOTUID=3201d407b7899a12d6d439950511c6a5Malware-related environment variable value
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
ALERT!: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
The post Malicious npm Packages Deploy Cross-Platform RAT Targeting Alibaba Developers appeared first on Cyber Security News.
