A recent supply chain attack has emerged, targeting developers utilizing Alibaba-related tools through a series of malicious npm packages. These packages deliver a cross-platform remote access trojan (RAT), compromising developer workstations and potentially exposing sensitive information.
Attack Methodology
The attackers employed a layered dependency chain, where top-level packages mimicked private Alibaba packages under the ‘ali’ scope. Upon installation, these packages introduced additional dependencies that facilitated the download and execution of malicious code. This method mirrors tactics observed in previous npm supply chain attacks, where seemingly benign dependencies serve as entry points for more extensive compromises.
To evade detection, the malicious packages were published through various maintainer accounts, obscuring their interconnected nature. The dependency chain retrieved a configuration file from an attacker-controlled GitHub repository, saving it locally as ‘.cloud-preferences.json’. A package named ‘local-config-parser’ then processed this file, enabling the execution of concealed code on the victim’s machine.
Payload Execution and Persistence
The malicious code exploited a known vulnerability in Node.js virtual-machine isolation, allowing it to access the host process and download additional payloads from infrastructure hosted on Alibaba Cloud. This approach likely aimed to make the malicious traffic blend in with legitimate activity.
The attack was tailored to the victim’s operating system:
- macOS: Added persistence through modifications to ‘.zshrc’ and the creation of a Launch Agent.
- Windows: Replaced the ‘app.asar’ file of the Alilang security application.
- Linux: Executed a temporary binary running in the background.
RAT Capabilities and Targeted Tools
The final payload, named ‘aone-cli’, is a remote access trojan designed for systems connected to Alibaba’s internal development ecosystem. Its capabilities include:
- Executing shell commands.
- Uploading and downloading files.
- Collecting host details.
- Staging additional payloads.
- Creating an encrypted reverse TCP proxy.
Notably, the malware focuses on enterprise tools such as DingTalk, Wukong, and Qoder. It can modify Python scripts within application ‘.skills’ directories, inserting hidden scripts that facilitate persistence and lateral movement across developer environments.
Indicators of Compromise and Recommendations
Organizations that have installed any of the affected packages should consider their environments compromised and initiate remediation from a clean device. Steps include:
- Preserving forensic evidence where possible.
- Removing the malicious packages.
- Rotating exposed development and cloud secrets.
- Inspecting Python files for the ‘INJECTMARKER’ value.
Security teams should identify all developer workstations that installed the affected dependencies, review suspicious DingTalk activity, and monitor for connections to the command-and-control infrastructure associated with this threat. Reviewing requests that use forged DingTalk ‘Origin’ and ‘Referer’ headers can help uncover communications tied to this attack.
This incident underscores the critical importance of scrutinizing third-party dependencies and maintaining robust security practices within development environments. As supply chain attacks become more sophisticated, developers and organizations must remain vigilant to protect their systems and data.
