18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users

Cybersecurity researchers have uncovered a sophisticated software supply chain attack targeting users of Alibaba developer tools with a cross-platform remote access trojan (RAT). The campaign, discovered by Socket security researcher Karlo Zanki, involves 18 malicious npm packages that impersonate private Alibaba packages to infiltrate development environments.

The attack leverages a package named “lib-mtop,” which mimics a private Alibaba package under the “@ali” scope. Although initially published in November 2023 with no functionality, three new versions were uploaded in March and April, containing a loader that fetches and executes a remote JavaScript payload. The same maintainer account “ch4ce” published other packages, including aone-kit, aone-kit-cli, aone-sandbox, and local-config-parser, which together form a multi-layered dependency tree.

The malicious loader functionality is split across several packages, with top-layer lure packages impersonating private @ali-scoped packages. These decoys activate the installation of a dependency tree that includes “smart-config-manager,” a middle-layer bridge connecting to packages containing the loader logic. The loader retrieves a rule engine configuration from a GitHub repository and uses it to execute a payload that contacts a remote server for secondary malware.

The final payload is a complex backdoor with capabilities for command execution, file upload/download, host reconnaissance, and lateral movement. It can persist by injecting malicious code into enterprise collaboration applications like DingTalk, Wukong, and Qoder. The attack is believed to be the work of a Chinese-speaking threat actor, given the presence of Chinese language comments and UTC+08:00 timestamps in GitHub commits.

The campaign appears to target industrial espionage, with the impact hard to evaluate due to its targeted nature and lateral-spread capabilities. Users who installed any of the listed packages should assume compromise, rotate credentials, and audit systems for suspicious activity.

In a related disclosure, a poisoned version of the mrmustard Python library from Xanadu was found to run an information stealer that harvests SSH private keys, AWS credentials, and Kubernetes configurations, exfiltrating them to an attacker server. The attack involved breaching the maintainer’s GitHub account and exploiting self-hosted CI runners.