Cybersecurity researchers have identified a series of malicious npm packages designed to infiltrate systems of developers using Alibaba’s tools, deploying a cross-platform remote access trojan (RAT). This sophisticated supply chain attack appears to specifically target Chinese-speaking development environments.
One notable package, “lib-mtop,” mirrors the name of a private Alibaba package under the “@ali” scope. Initially published in November 2023 without functionality, three new versions (v1.0.1, v1.0.2, and v1.0.3) were uploaded between March and April 2026. These updates introduced a loader that fetches and executes a remote JavaScript payload using curl.
The maintainer account “ch4ce,” now inactive, also released four other packages: “aone-kit,” “aone-kit-cli,” “aone-sandbox,” and “local-config-parser.” The first three are empty wrappers mimicking private “@ali”-scoped packages, declaring them as dependencies in their package.json files. The fourth, “local-config-parser,” functions as a legitimate JSON configuration parser but includes dependencies that, when combined, facilitate the deployment of an advanced RAT targeting developers within Alibaba Group-affiliated companies.
The attack’s complexity lies in its multi-layered dependency structure. Top-layer packages impersonate private “@ali” packages, serving as decoys that trigger the installation of a malicious dependency tree. A middle-layer package, “smart-config-manager,” connects these decoys to the malicious components containing the loader logic. This loader contacts a GitHub repository to retrieve a rule engine configuration, which then executes a payload based on the victim’s operating system.
The payload retrieval process is particularly insidious. It fetches the final payload from a domain resembling Alibaba’s infrastructure (“aone-cli-next.oss-cn-beijing.aliyuncs[.]com”), aiding in evading detection. The attack’s final stage varies by operating system:
- Windows: Terminates the Alilang enterprise security application, replacing its core code with a trojanized version.
- Linux: Downloads a binary payload to the /tmp directory, executes it as a detached process, and deletes the file post-execution.
- macOS: Inserts a malicious background script into ~/.zshrc and sets up a Launch Agent to run every 10 minutes.
The deployed RAT is highly capable, offering functionalities such as command execution, file upload and download, system reconnaissance, payload staging, and lateral movement within networks.
This incident underscores the escalating sophistication of supply chain attacks targeting developer ecosystems. By exploiting trusted package repositories and mimicking legitimate packages, attackers can infiltrate development environments, potentially compromising entire organizations. Developers must exercise heightened vigilance when incorporating third-party packages, especially those mimicking private or internal tools. Implementing stringent dependency management practices and regularly auditing project dependencies are crucial steps in mitigating such risks.
