A cluster of malicious npm packages has been used to deliver a cross-platform remote access trojan against developers who use Alibaba-related tools.

The campaign hides its harmful code across several packages, making each part look ordinary when viewed on its own.

The attack relies on package names that imitate private Alibaba packages and adds malicious dependencies during installation.

This approach can expose developer workstations, source code, credentials, and internal collaboration environments to remote control.

Researchers at Socket.dev identified the activity after examining the lib-mtop package, which had received new versions after years of little activity.

Socket.dev said in a report shared with Cyber Security News (CSN) that the operation appears narrowly focused rather than widely distributed.

Although the malicious packages recorded limited downloads, the RAT’s ability to collect data, run commands, and move through DingTalk-related tools creates a potentially serious espionage risk for affected organizations.

Malicious npm Packages Deploy Cross-Platform RAT

The attackers used a layered dependency chain in which top-level lure packages copied the names of private packages under Alibaba’s ali scope.

When a developer installed one of these lookalikes, additional dependencies supplied the downloader and rule-processing components.

This technique reflects the wider risk seen in recent npm supply chain attacks, where a seemingly harmless dependency can become the entry point for a larger compromise.

The packages were published through different maintainer accounts, helping conceal their shared purpose.

The dependency chain fetched a configuration file from an attacker-controlled GitHub repository and saved it locally as .cloud-preferences.json.

Anatomy of a multi-stage supply-chain attack (Source - Socket.dev) — Anatomy of a multi-stage supply-chain attack (Source – Socket.dev)

A package named local-config-parser then evaluated the rules inside that file, allowing hidden code to run on the victim’s machine.

The malicious rule abused a known escape from Node.js virtual-machine isolation. It accessed the host process, recovered Node’s module-loading functions, and downloaded another payload from infrastructure hosted in Alibaba Cloud, likely to make malicious traffic appear less unusual.

The next stage profiles the host and selects a payload for macOS, Windows, or Linux.

On macOS, it adds persistence through .zshrc and a Launch Agent; on Windows, it replaces the app.asar file of the Alilang security application; on Linux, it runs a temporary binary in the background.

RAT Capabilities and Response

The final aone-cli payload is a remote access trojan built for systems connected to Alibaba’s internal development ecosystem.

It can execute shell commands, upload and download files, collect host details, stage additional payloads, and create an encrypted reverse TCP proxy.

Its focus on DingTalk, Wukong, and Qoder enterprise tools is particularly concerning.

The malware can alter Python scripts in application .skills directories so that a hidden script runs later, offering a route for persistence and lateral movement across developer environments.

This makes the campaign comparable to other developer-focused RAT malware campaigns, but its package impersonation and Alibaba-specific tooling suggest a more targeted objective.

The Chinese-language comments and China Standard Time commit metadata may point to a Chinese-speaking operator, though they do not establish attribution.

Teams that installed any listed package should treat the affected environment as compromised and begin remediation from a clean device.

They should preserve forensic evidence where possible, remove the packages, rotate exposed development and cloud secrets, and inspect Python files for the INJECTMARKER value.

Security teams should also identify every developer workstation that installed the affected dependencies, review suspicious DingTalk activity, and monitor for connections to the listed command-and-control infrastructure.

Reviewing requests that use forged DingTalk Origin and Referer headers can help uncover communications tied to this threat.

Organizations can reduce similar exposure by reviewing dependency changes before deployment and limiting package-install permissions in sensitive build environments.

Coverage of malicious package delivery methods and npm registry compromise incidents also underscores why developers must treat unexpected dependency updates as a security event.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
Malicious npm package	`lib-mtop`	Malicious downloader package
Malicious npm package	`aone-kit`	Top-layer lure package
Malicious npm package	`aone-kit-cli`	Top-layer lure package
Malicious npm package	`aone-sandbox`	Top-layer lure package
Malicious npm package	`local-config-parser`	Rule parser with malicious auto-initialization logic
Malicious npm package	`smart-config-manager`	Middle-layer dependency package
Malicious npm package	`cloud-config-fetcher`	Configuration-fetching dependency
Malicious npm package	`fast-transform-pipeline`	Testing and delivery package
Malicious npm package	`aone-cloud-cli`	Top-layer lure package
Malicious npm package	`colder-cli`	Top-layer lure package
Malicious npm package	`def-open-client`	Top-layer lure package
Malicious npm package	`feedback-ai-sdk`	Top-layer lure package
Malicious npm package	`flight-compare-analyzer`	Top-layer lure package
Malicious npm package	`lwp-web-client`	Top-layer lure package
Malicious npm package	`lzd-unified-station-sdk`	Top-layer lure package
Malicious npm package	`open-worker-cli`	Top-layer lure package
Malicious npm package	`test-skill-zip`	Top-layer lure package
Malicious npm package	`uniapi-bridge`	Top-layer lure package
GitHub account	`smi1e2u`	Malicious maintainer account
GitHub repository	`fast-transform-pipeline`	Testing repository
GitHub repository	`smart-config-manager`	Repository containing malicious configuration rules
SHA-256	`84a6ccaaab1596139d28e822f40cc99c68d337d4c81d1c6d9692c1d6bb22e4af`	`preferences.json` configuration file
SHA-256	`6044974c633b3a319c31bb32110411520c425e89722a64806528553227e7a50a`	`setting.js` third-stage loader
SHA-256	`0910ecfa049738ef3f2540855341a380df89224ff71da94b4c21689fd66f62e3`	`aone-cli.js` deployed on macOS
SHA-256	`b8b81af76163bdcc5b4f7d8fe6795f164991f8a62678c971db031b9e90a27813`	`aone-cli` deployed on Linux
SHA-256	`ef9a1896eeaae929800eade768276e2240ef252d26d0d96c1950a1a5e1aadb34`	`aone-cli.zip` deployed on Windows
SHA-256	`e5d8350f1540fe91145dc262c455bca7748ad97dafb2d9facd5adebed9f66d2d`	`aone-cli-deps.tar.gz` older payload version
SHA-256	`41957bd0ba2d9c07af2e069f10780fdf6b2102c065bebe0db2136dfe07d67a28`	`crypto.js` third-stage loader
SHA-256	`33b58598eb317553942e27545982d4c25ce6120eae10e42393746eb0e02ecae9`	`aone-kit-update` Linux payload
C2 domain	`xemzqli2vu.ai-app.pub`	Primary command-and-control domain
C2 domain	`diamond-cli-znsxphqell.cn-shanghai.fcapp.run`	Reverse-proxy WebSocket command-and-control endpoint
Payload URL	`hxxps://aone-cli-next.oss-cn-beijing.aliyuncs.com/config/setting.js`	Third-stage loader delivery
Payload URL	`hxxps://aone-ai-cli.oss-cn-beijing.aliyuncs.com/app/release/aone-cli.js`	macOS payload delivery
Payload URL	`hxxps://aone-ai-cli.oss-cn-beijing.aliyuncs.com/app/release/aone-cli-deps.tar.gz`	Payload dependency archive
Payload URL	`hxxps://aone-ai-cli.oss-cn-beijing.aliyuncs.com/app/release/aone-cli`	Linux payload delivery
Payload URL	`hxxps://aone-ai-cli.oss-cn-beijing.aliyuncs.com/app/release/aone-cli.zip`	Windows payload delivery
Payload URL	`hxxps://aone-kit.oss-cn-beijing.aliyuncs.com/plugins/crypto.js`	`lib-mtop` payload delivery
Payload URL	`hxxps://aone-kit.oss-cn-beijing.aliyuncs.com/aone-kit-update/aone-kit.js`	Linux payload delivery
Payload URL	`hxxps://aone-kit.oss-cn-beijing.aliyuncs.com/aone-kit-update/app.asar`	Trojanized Windows application archive
Configuration indicator	`INJECTMARKER`	Marker used to identify injected Python code
Environment variable	`ROBOTUID=3201d407b7899a12d6d439950511c6a5`	Malware-related environment variable value

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

ALERT!: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.

The post Malicious npm Packages Deploy Cross-Platform RAT Targeting Alibaba Developers appeared first on Cyber Security News.