18 Malicious npm Packages Target Alibaba Devs with RAT
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Socket researchers identified 18 malicious npm packages targeting developers of Alibaba Group internal tools with a cross-platform RAT as part of a sophisticated, targeted software supply chain attack
- lib-mtop impersonated a private Alibaba "@ali" scope package — first published as a benign package in November 2023, then updated with malicious loader code in versions v1.0.1, v1.0.2, and v1.0.3 in March and April
- Maintainer "ch4ce" published five packages on npm, with three (aone-kit, aone-kit-cli, aone-sandbox) serving as empty wrappers that declare the impersonated @ali-scoped private packages as dependencies to activate the malicious tree
- The attack uses a layered dependency chain — 10 top-layer lure packages depend on "smart-config-manager," which bridges to low-layer packages whose loader logic fetches a rule engine configuration from a GitHub repository
- The payload is delivered from an Alibaba-masquerading domain (aone-cli-next.oss-cn-beijing.aliyuncs.com) and uses the Node.js vm module to execute OS-specific malware: Windows trojanizes Alilang enterprise security, Linux drops a binary to /tmp, and macOS adds a ~/.zshrc script with a 10-minute Launch Agent
- The final-stage backdoor supports command execution, arbitrary file upload/download, host reconnaissance, payload staging, and lateral movement, and persists by injecting code into enterprise collaboration apps DingTalk, Wukong, and Qoder
- The campaign appears to be the work of a Chinese-speaking threat actor — Chinese language comments in source code and UTC+08:00 GitHub commit timestamps point to industrial espionage as the likely goal, per Socket researcher Karlo Zanki
Why it matters: For any Alibaba Group developer who installed one of the 18 listed packages, this means assumed compromise: sensitive credentials must be rotated from a clean machine and developer systems audited. The payload's targeted nature, combined with lateral-movement and persistence inside enterprise collaboration apps like DingTalk, makes the blast radius hard to evaluate even though download counts are low.
