A cluster of malicious npm packages has been used to deliver a cross-platform remote access trojan against developers who rely on Alibaba-related tooling. The campaign hides its harmful code across several packages, making each component look ordinary when viewed in isolation.

The attack impersonates private Alibaba package names and adds malicious dependencies during installation, creating a path from a routine npm install to full remote control of a developer’s machine.

Key Details

Researchers at Socket.dev identified the activity after examining the lib-mtop package, which received new versions after years of little activity. The operation appears narrowly focused rather than widely distributed, with limited downloads but high-impact capabilities.

The attackers used a layered dependency chain in which top-level “lure” packages copied names under Alibaba’s ali scope. When a developer installed one of these lookalikes, additional dependencies supplied:

• A downloader component.
• A rule-processing component.
• A configuration fetcher that pulled rules from an attacker-controlled GitHub repository.

The downloaded configuration was saved locally as .cloud-preferences.json. A package named local-config-parser then evaluated the rules inside that file, allowing hidden code to run on the victim’s machine.

Technical Analysis

The malicious rule abused a known escape from Node.js virtual-machine isolation. It accessed the host process, recovered Node’s module-loading functions, and downloaded another payload from infrastructure hosted in Alibaba Cloud, likely to make malicious traffic appear less unusual.

The next stage profiles the host and selects a payload for macOS, Windows, or Linux. Persistence mechanisms differ by platform:

• On macOS, it adds persistence through .zshrc and a Launch Agent.
• On Windows, it replaces the app.asar file of the Alilang security application.
• On Linux, it runs a temporary binary in the background.

The final aone-cli payload is a remote access trojan built for systems connected to Alibaba’s internal development ecosystem. Its capabilities include:

• Executing shell commands.
• Uploading and downloading files.
• Collecting host details.
• Staging additional payloads.
• Creating an encrypted reverse TCP proxy.

The malware’s focus on DingTalk, Wukong, and Qoder enterprise tools is particularly concerning. It can alter Python scripts in application .skills directories so that a hidden script runs later, offering a route for persistence and lateral movement across developer environments.

Why It Matters

Although the malicious packages recorded limited downloads, the RAT’s ability to collect data, run commands, and move through DingTalk-related tools creates a potentially serious espionage risk for affected organizations.

This technique reflects the wider risk seen in recent npm supply chain attacks, where a seemingly harmless dependency can become the entry point for a larger compromise. The use of multiple maintainer accounts and lookalike package names makes detection harder for both developers and automated tooling.

For teams using Alibaba-related internal tools, the threat is not just code theft. It is also the risk of long-term remote access, credential exposure, and lateral movement across collaboration environments.

Expert Recommendations

Teams that installed any of the listed packages should treat the affected environment as compromised and begin remediation from a clean device. The goal is to assume the workstation, credentials, and local secrets are no longer trustworthy.

Recommended actions:

• Preserve forensic evidence where possible before wiping.
• Remove the malicious packages and related dependencies.
• Rotate exposed development and cloud secrets.
• Inspect Python files for the INJECTMARKER value.
• Identify every developer workstation that installed the affected dependencies.
• Review suspicious DingTalk activity and related enterprise tools.
• Monitor for connections to the listed command-and-control infrastructure.
• Review requests that use forged DingTalk Origin and Referer headers.

Organizations can reduce similar exposure by reviewing dependency changes before deployment and limiting package-install permissions in sensitive build environments. Coverage of malicious package delivery methods and npm registry compromise incidents also underscores why developers must treat unexpected dependency updates as a security event.

Industry Context

This campaign is comparable to other developer-focused RAT malware campaigns, but its package impersonation and Alibaba-specific tooling suggest a more targeted objective. Chinese-language comments and China Standard Time commit metadata may point to a Chinese-speaking operator, though they do not establish attribution.

The incident reinforces that npm is now a high-value attack surface for espionage and supply chain compromise. Attackers are increasingly combining social engineering (package names) with technical tricks (VM escapes, staged loaders) to reach developer machines.

Conclusion

The malicious npm package cluster shows how a small, focused campaign can still create a major risk when it targets developer environments and internal tooling. For affected teams, the priority is to assume compromise, rotate secrets, and rebuild from clean systems.

FAQ SECTION

What did the malicious npm packages do?

They delivered a cross-platform remote access trojan that can execute commands, collect data, and move through Alibaba-related developer tools.

How did the attack start?

Developers installed lookalike packages that impersonated private Alibaba npm packages, triggering a multi-stage malicious dependency chain.

Which platforms are affected?

The RAT supports macOS, Windows, and Linux, with different persistence techniques on each platform.

What should teams do if they installed these packages?

Treat the environment as compromised, rotate secrets, inspect Python files for INJECTMARKER, and rebuild from a clean device.

Why is this campaign notable?

It combines npm supply chain techniques with a targeted focus on Alibaba internal tools and DingTalk, creating a high-risk espionage path.