Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers

Summary

Threat actors are distributing a sophisticated Remote Access Trojan (RAT) through a series of malicious npm packages designed to mimic legitimate Alibaba development tools. The campaign, which remained undetected for three months, uses a multi-stage approach where seemingly innocent packages download and execute increasingly malicious payloads. The final RAT is capable of data exfiltration, command execution, and lateral movement within targeted developer environments, with a particular focus on Alibaba Group's internal tools.

Full text

Research/Security NewsTwo Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access TrojanTwo Joyfill npm beta releases contain an import-time implant that uses blockchain transactions to retrieve a remote-access trojan.By Socket Research Team - Jul 28, 2026

Indicators of Compromise

• url — hxxps://raw[.]githubusercontent[.]com/smi1e2u/smart-config-manager/main/defaults/preferences.json
• url — hxxps://aone-cli-next[.]oss-cn-beijing[.]aliyuncs[.]com/config/setting.js
• url — hxxps://aone-ai-cli[.]oss-cn-beijing[.]aliyuncs[.]com/app/release/aone-cli.js
• url — hxxps://aone-ai-cli[.]oss-cn-beijing[.]aliyuncs[.]com/app/release/aone-cli-deps.tar.gz
• url — hxxps://aone-ai-cli[.]oss-cn-beijing[.]aliyuncs[.]com/app/release/aone-cli
• url — hxxps://aone-ai-cli[.]oss-cn-beijing[.]aliyuncs[.]com/app/release/aone-cli.zip
• url — hxxps://aone-kit[.]oss-cn-beijing[.]aliyuncs[.]com/plugins/crypto.js
• url — hxxps://aone-kit[.]oss-cn-beijing[.]aliyuncs[.]com/aone-kit-update/aone-kit.js
• url — hxxps://aone-kit[.]oss-cn-beijing[.]aliyuncs[.]com/aone-kit-update/app.asar
• url — hxxps://aone-kit[.]oss-cn-beijing[.]aliyuncs[.]com/aone-kit-update/aone-kit-update
• domain — xemzqli2vu[.]ai-app[.]pub
• domain — diamond-cli-znsxphqell[.]cn-shanghai[.]fcapp[.]run
• hash_sha256 — 84a6ccaaab1596139d28e822f40cc99c68d337d4c81d1c6d9692c1d6bb22e4af
• hash_sha256 — 6044974c633b3a319c31bb32110411520c425e89722a64806528553227e7a50a
• hash_sha256 — 0910ecfa049738ef3f2540855341a380df89224ff71da94b4c21689fd66f62e3
• hash_sha256 — b8b81af76163bdcc5b4f7d8fe6795f164991f8a62678c971db031b9e90a27813
• hash_sha256 — ef9a1896eeaae929800eade768276e2240ef252d26d0d96c1950a1a5e1aadb34
• hash_sha256 — e5d8350f1540fe91145dc262c455bca7748ad97dafb2d9facd5adebed9f66d2d
• hash_sha256 — 41957bd0ba2d9c07ef2e069f10780fdf6b2102c065bebe0db2136dfe07d67a28
• hash_sha256 — 33b58598eb317553942e27545982d4c25ce6120eae10e42393746eb0e02ecae9

Entities