Malicious npm Packages Target Alibaba Developers with Cross-Platform RAT

Key Takeaways

• A sophisticated campaign leveraging malicious npm packages has been identified, specifically targeting developers utilizing Alibaba-related tools.
• The attack deploys a cross-platform Remote Access Trojan (RAT) capable of compromising developer workstations, exfiltrating source code and credentials, and gaining access to internal collaboration environments.
• The threat employs a multi-stage infection chain, using typo-squatting and mimicking private Alibaba packages to deliver its payload.
• While download counts were low, the targeted nature and the RAT’s capabilities pose a significant espionage risk.
• Immediate remediation steps are crucial for any organization that has installed the identified malicious packages.

A series of malicious npm packages have been detected distributing a cross-platform Remote Access Trojan (RAT) specifically designed to compromise developers working with Alibaba technologies. This operation strategically conceals its harmful components across multiple packages, each appearing benign in isolation.

The attack vector exploits package names that closely resemble legitimate, private Alibaba packages. During installation, these deceptive packages introduce additional malicious dependencies, establishing a foothold for the RAT. This method allows attackers to gain remote control over developer workstations, potentially exposing sensitive data such as source code, credentials, and access to internal collaboration platforms.

Security researchers at Socket.dev said in a report that they uncovered this activity after observing unusual updates to the lib-mtop package, which had been dormant for an extended period. The report, shared with Cyber Security News (CSN), suggests that this campaign is highly targeted rather than a broad-spectrum attack. Despite the malicious packages showing limited download numbers, the RAT’s extensive capabilities—including data collection, arbitrary command execution, and propagation through DingTalk-related tools—present a severe espionage threat to affected organizations.

Malicious npm Packages Deploy Cross-Platform RAT

The attackers orchestrated a multi-layered dependency chain. The initial “lure” packages were named to impersonate private packages within Alibaba’s ali scope. When a developer installed one of these lookalike packages, subsequent malicious dependencies were automatically pulled in, delivering the downloader and rule-processing components of the attack. This tactic highlights the increasing sophistication of supply chain attacks within the npm ecosystem, where a seemingly innocuous dependency can become the initial point of compromise. The use of various maintainer accounts further obscured the coordinated nature of these malicious packages.

The infection chain begins with fetching a configuration file from a GitHub repository controlled by the attackers. This file, named .cloud-preferences.json, is saved locally on the victim’s system. Subsequently, a package named local-config-parser processes the rules embedded within this configuration file, enabling the execution of hidden malicious code on the compromised machine.

This malicious rule exploited a known bypass for Node.js virtual-machine isolation, allowing it to access the host process. From there, it retrieved Node’s module-loading functions and downloaded an additional payload from Alibaba Cloud infrastructure. This choice of hosting infrastructure likely aimed to make the malicious traffic appear less suspicious by blending in with legitimate Alibaba Cloud activity.

The subsequent stage of the attack involves profiling the victim’s operating system to deliver an appropriate payload for macOS, Windows, or Linux. On macOS, the malware establishes persistence by modifying .zshrc and creating a Launch Agent. For Windows systems, it replaces the app.asar file of the Alilang security application. On Linux, a temporary binary is executed in the background to maintain covert access.

RAT Capabilities and Response

The ultimate payload, identified as aone-cli, functions as a potent remote access trojan specifically tailored for environments integrated with Alibaba’s internal development ecosystem. Its capabilities include the execution of shell commands, file upload and download, collection of host system details, staging of further payloads, and the creation of an encrypted reverse TCP proxy. The RAT’s particular focus on enterprise tools like DingTalk, Wukong, and Qoder is a significant concern.

The malware can modify Python scripts located in application .skills directories, embedding a hidden script that ensures persistent execution and facilitates lateral movement across developer environments. This campaign shares similarities with other developer-centric RAT attacks but distinguishes itself through its specific package impersonation and targeting of Alibaba-specific tools, suggesting a highly focused objective. The presence of Chinese-language comments and commit metadata timestamped in China Standard Time may indicate a Chinese-speaking operator, although this does not definitively attribute the attack.

What You Should Do

• Any development teams that have installed the identified malicious npm packages should consider their affected environments compromised and initiate remediation processes from a clean system.
• Preserve all available forensic evidence for further investigation.
• Immediately remove all identified malicious packages from your systems.
• Rotate all exposed development and cloud credentials and secrets.
• Inspect Python files within your environment for the presence of the INJECTMARKER value, indicating potential code injection.
• Security teams should identify all developer workstations where the affected dependencies were installed.
• Review all suspicious activity related to DingTalk and monitor for any connections to the listed command-and-control (C2) infrastructure.
• Analyze network requests for forged DingTalk Origin and Referer headers, which could reveal communications linked to this threat.
• Implement stricter dependency review processes before deploying new packages and limit package installation permissions within sensitive build environments.
• Treat any unexpected dependency updates as a critical security incident.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.