18 Malicious npm Packages Target Alibaba With Cross-Platform RAT
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Socket researchers discovered 18 malicious npm packages — including "lib-mtop," aone-kit, aone-kit-cli, aone-sandbox, and local-config-parser — that impersonate private Alibaba packages under the "@ali" scope and deliver a cross-platform RAT.
- The attack uses a multi-layered dependency tree in which approximately 10 top-layer decoy packages depend on "smart-config-manager," a middle-layer bridge that connects them to low-layer packages containing the loader logic.
- The loader fetches a rule engine configuration from a GitHub repository, then contacts a remote server at "aone-cli-next.oss-cn-beijing.aliyuncs[.]com," a domain designed to masquerade as Alibaba infrastructure and evade detection.
- Payload execution varies by OS: on Windows the malware terminates Alilang enterprise security and replaces it with a trojanized version; on Linux it runs a detached binary from /tmp and deletes the file; on macOS it injects a script into ~/.zshrc and installs a 10-minute Launch Agent.
- The final payload is a full-featured backdoor with command execution, arbitrary file upload/download, host reconnaissance, and lateral movement — and it persists by injecting malicious code into enterprise collaboration apps DingTalk, Wukong, and Qoder.
- Socket researcher Karlo Zanki noted that Chinese-language source comments and UTC+08:00 GitHub commit timestamps suggest a Chinese-speaking threat actor, and assessed the campaign's goal as industrial espionage targeting Alibaba Group developers.
Why it matters: Any developer at an Alibaba Group company who installed one of these 18 packages should assume full credential and system compromise, because the final-stage payload carries lateral-movement and persistence capabilities — including code injection into DingTalk, Wukong, and Qoder — that let it spread beyond the initially infected machine inside the corporate environment.
