18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users

Summary

Cybersecurity researchers have identified 18 malicious npm packages designed to deliver a cross-platform remote access trojan (RAT) to users of Alibaba developer tools. The attack targets Chinese-speaking environments by impersonating legitimate private Alibaba packages. The RAT can terminate security software, execute malicious payloads, and persist by injecting code into enterprise collaboration applications.

Full text

18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users Ravie LakshmananAug 03, 2026Malware / Software Supply Chain Cybersecurity researchers have discovered a new set of malicious npm packages that target users of Alibaba developer tools with a cross-platform remote access trojan (RAT) as part of a sophisticated, targeted software supply chain attack targeting Chinese-speaking environments. One of the packages in question is "lib-mtop," an unscoped package with the same name as a private Alibaba package under the "@ali" scope. Although the npm package was first published sometime in November 2023 with no functionality, three new versions (v1.0.1, v1.0.2, and v1.0.3) were uploaded earlier this March and April. It's currently not clear if this was the result of a maintainer account takeover or the project developer opting to go rogue. Regardless of how the malicious changes were pushed, the newly added changes feature a loader that's designed to fetch a remote JavaScript payload using curl and then execute it. The same maintainer account "ch4ce," which currently redirects to a "not found" error on npmjs[.]com, has also published four other packages: aone-kit, aone-kit-cli, aone-sandbox, and local-config-parser. "The first three are empty wrappers that have the same name as private, @ali-scoped packages which they declare as a dependency in the package.json file," Socket security researcher Karlo Zanki said in an analysis. The last package, local-config-parser, implements a legitimate JSON configuration file parser, but features dependencies that, on their own, are innocuous and are published from other npm user accounts. When combined together, they serve as a conduit for an advanced RAT targeting developers who are likely working in companies that are part of the Alibaba Group. Specifically, the malicious loader functionality is split and embedded into several packages delivered to the targets as part of the same dependency tree. The top-layer packages, which impersonate private packages from the @ali scope, serve as decoys that activate the installation of the dependency tree. "When such a package is installed in an environment that has access to impersonated, scoped private packages, the dependency resolution works as expected, with a little extra functionality delivered through additional dependencies that get installed," Socket explained. As many as 10 top-layer lure packages have been found to depend on "smart-config-manager," which functions akin to a middle-layer bridge that connects them to the malicious packages containing the loader logic. One of the low-layer packages proceeds to contact a GitHub repository to retrieve and store a rule engine configuration, and then it uses it to execute a malicious payload that then contacts a remote server to fetch secondary malware. What's notable about the attack is that the rule engine makes use of the vm module to implement the final phase and perform the payload download depending on the victim's operating system. The payload is retrieved from a domain that masquerades as Alibaba ("aone-cli-next.oss-cn-beijing.aliyuncs[.]com") to blend in and sidestep detection. This stage performs a number of actions - On Windows, it terminates the Alilang enterprise security, VPN, and office productivity app and replaces its core code with a trojanized version. On Linux, it downloads a binary payload to /tmp, runs it as a detached process, and deletes the file from disk after it's loaded into memory. On macOS, it inserts a malicious background script into ~/.zshrc and sets up a 10-minute Launch Agent. The final payload is a complex backdoor equipped with comprehensive command execution, arbitrary file upload and download, host reconnaissance, payload staging, and lateral movement capabilities. It also has the capacity to persist by injecting malicious code into common enterprise collaboration applications like DingTalk, Wukong, and Qoder. Exactly who is behind the campaign is unknown, but the presence of Chinese language comments in the source code, combined with the fact that GitHub commits are timestamped with the UTC+08:00 offset, indicates that it's possibly the work of a Chinese-speaking threat actor going after Chinese-speaking developers using tools belonging to Alibaba Group. "The goal of the campaign seems to be industrial espionage," Zanki noted. "While the number of downloads for the malicious packages is not significant, the impact of the campaign is hard to evaluate, because of the targeted nature and lateral-spread capabilities of the final-stage payload." The complete set of packages associated with the campaign is below - lib-mtop aone-kit aone-kit-cli aone-sandbox local-config-parser smart-config-manager cloud-config-fetcher fast-transform-pipeline aone-cloud-cli colder-cli def-open-client feedback-ai-sdk flight-compare-analyzer lwp-web-client lzd-unified-station-sdk open-worker-cli test-skill-zip uniapi-bridge Users who have installed any of the above packages should assume compromise, rotate sensitive credentials from a clean machine, and audit developer systems for signs of suspicious activity. The disclosure comes as unknown threat actors published a poisoned version of mrmustard (0.7.4), the photonic quantum computing Python library from Xanadu, to run an information stealer capable of harvesting SSH private keys, AWS credentials, and Kubernetes configurations, and exfiltrating them to an attacker server ("metrics.femboy[.]energy"). According to StepSecurity, the payload runs on every package import. Further analysis indicates that the primary maintainer's GitHub account was breached to push the rogue version by probing the project's self-hosted CI runners and exfiltrating its publishing secrets to a webhook[.]site URL. The malware "had three separate persistence mechanisms installed that keep a stealer running long after the package is uninstalled," SafeDep said. "The credential theft targets research and HPC environments, collecting SLURM job queues and GPU inventories alongside the usual cloud secrets." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Credential Theft, Developer Security, linux, macos security, Malware, Open Source, Package Security, Remote Access Trojan, Software Supply Chain, Windows Security ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malw

Indicators of Compromise

• domain — aone-cli-next.oss-cn-beijing.aliyuncs.com

Entities