A new wave of malicious **npm** packages has been identified, designed to infiltrate the systems of developers utilizing **Alibaba** tools. This targeted software supply chain attack deploys a potent cross-platform Remote Access Trojan (RAT), raising significant concerns for IT security professionals and privacy-conscious users.  ### Impersonating Private Alibaba Packages One of the key malicious packages, **"lib-mtop,"** is an unscoped package that mirrors the name of a private **Alibaba** package under the `@ali` scope. Initially published in November 2023 without functionality, three new versions (**v1.0.1**, **v1.0.2**, and **v1.0.3**) surfaced in March and April. These updated versions now include a loader designed to fetch and execute a remote JavaScript payload using `curl`. It remains unclear whether this was a result of a maintainer account takeover or a developer intentionally turning rogue. The maintainer account, **"ch4ce,"** which has since been removed from **npmjs.com**, was also responsible for publishing four other packages: **aone-kit**, **aone-kit-cli**, **aone-sandbox**, and **local-config-parser**. **Karlo Zanki**, a security researcher at **Socket**, noted in an analysis that the first three are empty wrappers that declare legitimate, private `@ali`-scoped packages as dependencies. The **local-config-parser** package, while implementing a legitimate JSON configuration file parser, cleverly combines innocuous dependencies from other **npm** user accounts to form a conduit for the advanced RAT. ### The Multi-Stage Infection Chain This attack strategically splits its malicious loader functionality across several packages within the dependency tree. Top-layer packages, masquerading as private `@ali` scope packages, act as decoys, triggering the installation of the broader malicious dependency tree. According to **Socket**, when such a package is installed in an environment with access to the impersonated, scoped private packages, the dependency resolution proceeds as expected, but with additional malicious functionality delivered through the extra dependencies.  Up to ten top-layer lure packages have been found to depend on **"smart-config-manager,"** which acts as a middle-layer bridge connecting them to packages containing the loader logic. One of the lower-layer packages then contacts a **GitHub** repository to retrieve a rule engine configuration. This engine then executes a malicious payload, which subsequently fetches secondary malware from a remote server. ### Sophisticated Payload and Persistence The attack's sophistication is highlighted by its use of the `vm` module in the rule engine to tailor the final payload download based on the victim's operating system. The payload is retrieved from a domain mimicking **Alibaba** (**aone-cli-next.oss-cn-beijing.aliyuncs[.]com**) to evade detection. Upon execution, the payload performs several platform-specific actions: * **Windows**: Terminates the **Alilang** enterprise security, VPN, and office productivity app, replacing its core code with a trojanized version. * **Linux**: Downloads a binary payload to `/tmp`, executes it as a detached process, and deletes the file from disk after it's loaded into memory. * **macOS**: Inserts a malicious background script into `~/.zshrc` and establishes a 10-minute **Launch Agent** for persistence. The final payload is a comprehensive backdoor, offering extensive command execution, arbitrary file upload and download, host reconnaissance, payload staging, and lateral movement capabilities. It also achieves persistence by injecting malicious code into common enterprise collaboration applications such as **DingTalk**, **Wukong**, and **Qoder**. ### Attribution and Impact While the exact perpetrators remain unknown, the presence of Chinese language comments in the source code and **GitHub** commit timestamps with a **UTC+08:00** offset strongly suggest a Chinese-speaking threat actor targeting developers within the **Alibaba Group**. **Zanki** posits that the campaign's objective is industrial espionage. Though the download count for these malicious packages may not be substantial, the targeted nature and the final payload's lateral spread capabilities make the overall impact difficult to fully assess. ### List of Malicious Packages: * **lib-mtop** * **aone-kit** * **aone-kit-cli** * **aone-sandbox** * **local-config-parser** * **smart-config-manager** * **cloud-config-fetcher** * **fast-transform-pipeline** * **aone-cloud-cli** * **colder-cli** * **def-open-client** * **feedback-ai-sdk** * **flight-compare-analyzer** * **lwp-web-client** * **lzd-unified-station-sdk** * **open-worker-cli** * **test-skill-zip** * **uniapi-bridge** Users who have installed any of the packages listed above should immediately assume compromise. It is crucial to rotate all sensitive credentials from a clean machine and thoroughly audit developer systems for any signs of suspicious activity. ### Related Supply Chain Attacks This discovery follows another recent software supply chain compromise involving the **mrmustard** (**0.7.4**) Python library, a photonic quantum computing tool from **Xanadu**. Threat actors published a poisoned version containing an information stealer designed to harvest **SSH** private keys, **AWS** credentials, and **Kubernetes** configurations, exfiltrating them to an attacker-controlled server (**metrics.femboy[.]energy**). **StepSecurity** reported that this payload activates on every package import. Analysis by **StepSecurity** and **SafeDep** revealed that the primary maintainer's **GitHub** account was likely breached, allowing the rogue version to be pushed after exfiltrating publishing secrets from the project's self-hosted **CI** runners. The malware included three distinct persistence mechanisms to ensure the stealer continued running even after uninstallation, specifically targeting research and **HPC** environments by collecting **SLURM** job queues and **GPU** inventories alongside cloud secrets.