Malicious npm Packages Target Alibaba Developers with Cross-Platform RAT

Cybersecurity researchers have uncovered a sophisticated software supply chain attack comprising 18 malicious npm packages designed to deliver a cross-platform remote access trojan (RAT) to developers using Alibaba's internal tooling. The campaign, analyzed by Socket security researcher Karlo Zanki, specifically targets Chinese-speaking environments and impersonates private packages published under Alibaba's `@ali` scope. The most prominent decoy, `lib-mtop`, was first published in November 2023 as a benign placeholder, but three updated versions (v1.0.1, v1.0.2, and v1.0.3) were pushed in March and April containing a loader that fetches and executes remote JavaScript payloads via curl. Attackers may have achieved this through a maintainer account takeover or by the project developer going rogue—both vectors remain under investigation.

The maintainer account behind the operation, `ch4ce` (now returning a 404 on npmjs.com), also published `aone-kit`, `aone-kit-cli`, `aone-sandbox`, and `local-config-parser`. The first three are empty wrappers that mimic Alibaba's private scoped packages, while `local-config-parser` is a legitimate-looking JSON parser with hidden malicious dependencies. The attack relies on a layered dependency tree: as many as 10 top-layer lure packages depend on `smart-config-manager`, which acts as a bridge to lower-layer packages containing the loader logic. When installed in an environment with access to the real `@ali`-scoped packages, dependency resolution proceeds normally—but with additional malicious functionality smuggled in through the expanded dependency chain. Developers can verify suspicious domain infrastructure with a WHOIS lookup to identify attacker-controlled registries.

A standout feature of this campaign is the use of a remote rule engine configuration retrieved from a GitHub repository, which then determines the final payload based on the victim's operating system. The loader uses Node.js's built-in `vm` module to sandbox-execute the downloaded code, enabling cross-platform compatibility across Windows, macOS, and Linux. The final payload is fetched from a domain masquerading as a legitimate service, then connects to a remote command-and-control server to deliver secondary malware. Because the malicious behavior is fragmented across multiple packages, traditional single-package scanning tools are likely to miss the threat. Organizations should audit their npm dependencies for unexpected packages referencing the `@ali` scope and run a port scanner to detect any C2 beaconing activity on their developer networks. Any developer account potentially exposed should immediately perform credential validation and assess exposure with a email breach checker to determine if maintainer credentials were compromised.