18 npm Packages Used to Deliver Cross-Platform RAT to Alibaba Tool Users

Security researchers have identified 18 malicious npm packages involved in a targeted software supply-chain campaign against developers using Alibaba-related tools. The packages deliver a cross-platform remote access trojan (RAT) and appear designed to reach Chinese-speaking development environments.

The campaign includes lib-mtop, an unscoped package that shares its name with a private Alibaba package under the @ali namespace. After initially being published without apparent functionality in 2023, newer versions uploaded in March and April introduced a loader that uses curl to retrieve and execute JavaScript from a remote location.

Researchers said the same npm account published several additional packages that impersonate private Alibaba dependencies. Some act as largely empty wrappers, while others appear legitimate in isolation. Together, however, the packages form a staged dependency chain that activates during installation. Up to 10 lure packages reportedly depend on smart-config-manager, which links them to lower-level components containing the malicious logic.

One component retrieves a rule-engine configuration from GitHub. The rules use Node.js's vm module to determine which payload to download based on the victim's operating system. The download location uses an Alibaba-like domain to appear trustworthy.

Platform-specific behavior

• Windows: The malware can terminate Alibaba enterprise applications and replace core files with trojanized versions.
• Linux: It downloads and launches a binary from a temporary directory, then removes the file after loading it.
• macOS: It modifies ~/.zshrc and creates a Launch Agent scheduled to run periodically.

The final backdoor supports command execution, file transfers, host discovery, payload delivery and possible lateral movement. It may also inject code into collaboration tools including DingTalk, Wukong and Qoder.

The operators have not been identified. Chinese-language comments and UTC+08:00 commit timestamps suggest a possible Chinese-speaking actor, while the campaign's targeted design has led researchers to assess industrial espionage as a potential objective.

The affected package names include lib-mtop, aone-kit, aone-kit-cli, aone-sandbox, local-config-parser, smart-config-manager and 12 related packages. Organizations that installed them should treat affected systems as potentially compromised, rotate credentials from a clean device and investigate developer hosts for persistence or unauthorized activity.