Cross‑Platform RAT Infiltrates Alibaba Tools via 18 Malicious npm Packages

Key Takeaways

• Security researchers uncovered a coordinated software‑supply‑chain attack that injects a cross‑platform Remote Access Trojan (RAT) into npm packages mimicking private Alibaba (@ali) scoped libraries.
• The malicious activity originates from the npm account ch4ce, which published several decoy packages (e.g., lib‑mtop, aone‑kit, aone‑kit‑cli) that depend on a chain of intermediary packages ultimately delivering a loader that fetches and executes a remote JavaScript payload.
• The payload uses Node’s vm module to decide, based on the victim’s OS, whether to disable Alibaba security tools on Windows, drop a binary in /tmp on Linux, or modify ~/.zshrc and create a Launch Agent on macOS.
• Once executed, the final backdoor provides full command execution, file exfiltration, host reconnaissance, lateral movement, and persistence by trojanizing enterprise collaboration apps such as DingTalk, Wukong, and Qoder.
• Attribution clues—Chinese‑language comments in the source code and GitHub timestamps in UTC+08:00—suggest a Chinese‑speaking threat actor targeting developers within Alibaba‑related environments.
• Organizations that have installed any of the listed packages should assume compromise, rotate credentials from a clean system, and audit developer workstations for signs of the backdoor.
• A separate incident involving a poisoned version of the Python library mrmustard demonstrates that similar supply‑chain tampering is being used to steal SSH keys, cloud credentials, and Kubernetes configs in research and HPC settings.

Discovery of the Malicious npm Packages
Cybersecurity researchers identified a new set of harmful npm packages designed to infiltrate developers who rely on Alibaba’s internal tooling. The campaign centers on a package named lib‑mtop, an unscoped library that shares its name with a legitimate private package under the @ali scope. Although lib‑mtop first appeared in November 2023 as an empty placeholder, three updated versions (v1.0.1‑v1.0.3) were uploaded in March and April 2024, introducing malicious functionality.

The Ch4ce Account and Associated Packages
All of the tainted packages trace back to the npm user ch4ce, whose profile now returns a “not found” error on npmjs.com. Besides lib‑mtop, this account published four other packages: aone‑kit, aone‑kit‑cli, aone‑sandbox, and local‑config‑parser. The first three act as empty wrappers that declare the corresponding private @ali‑scoped packages as dependencies, while local‑config‑parser provides a seemingly benign JSON configuration parser but pulls in additional dependencies from unrelated accounts.

Multi‑Layered Delivery Mechanism
The attack employs a layered dependency tree to evade casual inspection. Top‑layer lure packages (such as lib‑mtop and the aone‑* series) masquerade as legitimate @ali scoped libraries. When installed in an environment that can resolve the real private packages, the dependency manager proceeds to install the declared dependencies, which include a middle‑layer package called smart‑config‑manager. This bridge ultimately leads to low‑level packages that contain the actual loader logic. As many as ten top‑layer packages have been found to depend on smart‑config‑manager, amplifying the reach of the campaign.

Loader Logic and Remote Payload Retrieval
Embedded within the low‑layer packages is a loader that uses curl to fetch a remote JavaScript payload from a domain designed to mimic Alibaba’s infrastructure: aone‑cli‑next.oss‑cn‑beijing.aliyuncs[.]com. The loader executes the retrieved script, which then leverages Node’s vm module to act as a rule engine. Depending on the victim’s operating system, the rule engine selects a specific malicious routine.

OS‑Specific Malicious Actions

• Windows: The payload terminates the Alilang enterprise security, VPN, and office productivity applications, then replaces their core executables with trojanized versions to maintain stealth.
• Linux: It downloads a binary payload to /tmp, runs it as a detached process, and deletes the file from disk after it has been loaded into memory, leaving only the malicious code resident.
• macOS: It inserts a malicious background script into ~/.zshrc and creates a Launch Agent that executes every ten minutes, ensuring persistence across reboots and user sessions.

Capabilities of the Final Backdoor
Once the OS‑specific stage completes, the payload delivers a fully featured backdoor. The trojan offers arbitrary command execution, file upload/download, host reconnaissance, payload staging, and lateral movement across the network. To maintain long‑term access, it injects malicious code into widely used enterprise collaboration tools such as DingTalk, Wukong, and Qoder, allowing the attacker to piggyback on legitimate processes and evade detection by endpoint protections.

Attribution and Motivation
While the precise threat actor remains unidentified, several indicators point to a Chinese‑speaking group. The source code contains Chinese language comments, and GitHub commits associated with the malicious versions are timestamped with the UTC+08:00 offset, aligning with China Standard Time. Researchers assess the campaign’s goal as industrial espionage, aiming to siphon proprietary data, credentials, and internal tooling from developers within Alibaba‑affiliated organizations. Although the absolute number of package downloads is modest, the highly targeted nature and the backdoor’s lateral‑movement capabilities mean the potential impact could be substantial.

Complete List of Compromised Packages
The full set of npm packages tied to the operation includes:
lib‑mtop, aone‑kit, aone‑kit‑cli, aone‑sandbox, local‑config‑parser, smart‑config‑manager, cloud‑config‑fetcher, fast‑transform‑pipeline, aone‑cloud‑cli, colder‑cli, def‑open‑client, feedback‑ai‑sdK, flight‑compare‑analyzer, lwp‑web‑client, lzd‑unified‑station‑sdk, open‑worker‑cli, test‑skill‑zip, uniapi‑bridge.
Any system that has installed one or more of these should be considered compromised.

Recommended Response and Mitigation
Organizations are advised to:

1. Immediately cease use of the listed packages and remove them from all development environments.
2. Rotate all sensitive credentials (API keys, passwords, certificates) from a known‑clean machine, as the backdoor may have harvested them.
3. Conduct thorough forensic audits of developer workstations, looking for unauthorized processes, modified binaries in /tmp or ~/, anomalous zshrc entries, and suspicious Launch Agents or scheduled tasks.
4. Implement software‑composition analysis (SCA) and lock‑file integrity checks to prevent future installation of typosquatted or dependency‑confusion packages.
5. Enforce least‑privilege principles for npm publish tokens and monitor maintainer accounts for unexpected activity.

Parallel Supply‑Chain Incident: Poisoned mrmustard
The disclosure of the Alibaba‑targeted npm attack coincides with another supply‑chain abuse involving the Python library mrmustard (version 0.7.4). A compromised version was published to exfiltrate SSH private keys, AWS credentials, and Kubernetes configurations to the attacker‑controlled server metrics.femboy[.]email. Analysis revealed that the malicious code executes on every package install, leveraging a breached maintainer account to push the rogue version via the project’s self‑hosted CI runners. The malware installed three persistence mechanisms, enabling long‑term credential theft in research and high‑performance computing (HPC) environments, including harvesting SLURM job queues and GPU inventories.

Conclusion
The lib‑mtop‑based campaign illustrates how attackers exploit the trust developers place in widely used package managers, using dependency‑confusion and typosquatting tactics to deliver sophisticated, cross‑platform malware. By impersonating private Alibaba packages and chaining multiple benign‑looking dependencies, the threat actors managed to fetch and execute a versatile RAT capable of deep system infiltration and persistence. Vigilant dependency verification, credential rotation, and robust endpoint monitoring are essential defenses against such stealthy supply‑chain threats.