18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users Contact/Tip Us Reach out to get featured—contact us to send your exclusive story idea, research, hacks, or ask us a question or leave a comment/feedback! Follow Us On Social Media RSS Feeds Email Alerts 18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users Ravie Lakshmanan Aug 03, 2026 Malware / Software Supply Chain Cybersecurity researchers have discovered a new set of malicious npm packages that target users of Alibaba developer tools with a cross-platform remote access trojan (RAT) as part of a sophisticated, targeted software supply chain attack targeting Chinese-speaking environments. One of the packages in question is ” lib-mtop ,” an unscoped package with the same name as a private Alibaba package under the “@ali” scope. Although the npm package was first published sometime in November 2023 with no functionality, three new versions (v1.0.1, v1.0.2, and v1.0.3) were uploaded earlier this March and April. It’s currently not clear if this was the result of a maintainer account takeover or the project developer opting to go rogue. Regardless of how the malicious changes were pushed, the newly added changes feature a loader that’s designed to fetch a remote JavaScript payload using curl and then execute it. The same maintainer account ” ch4ce ,” which currently redirects to a “not found” error on npmjs[.]com, has also published four other packages: aone-kit, aone-kit-cli, aone-sandbox, and local-config-parser. “The first three are empty wrappers that have the same name as private, @ali-scoped packages which they declare as a dependency in the package.json file,” Socket security researcher Karlo Zanki said in an analysis. The last package, local-config-parser, implements a legitimate JSON configuration file parser, but features dependencies that, on their own, are innocuous and are published from other npm user accounts. When combined together, they serve as a conduit for an advanced RAT targeting developers who are likely working in companies that are part of the Alibaba Group. Specifically, the malicious loader functionality is split and embedded into several packages delivered to the targets as part of the same dependency tree. The top-layer packages, which impersonate private packages from the @ali scope, serve as decoys that activate the installation of the dependency tree. “When such a package is installed in an environment that has access to impersonated, scoped private packages, the dependency resolution works as expected, with a little extra functionality delivered through additional dependencies that get installed,” Socket explained. As many as 10 top-layer lure packages have been found to depend on “smart-config-manager,” which functions akin to a middle-layer bridge that connects them to the malicious packages containing the loader logic. One of the low-layer packages proceeds to contact a GitHub repository to retrieve and store a rule engine configuration, and then it uses it to execute a malicious payload that then contacts a remote server to fetch secondary malware. What’s notable about the attack is that the rule engine makes use of the vm module to implement the final phase and perform the payload download depending on the victim’s operating system. The payload is retrieved from a domain that masquerades as Alibaba (“aone-cli-next.oss-cn-beijing.aliyuncs[.]com”) to blend in and sidestep detection. This stage performs a number of actions – On Windows, it terminates the Alilang enterprise security, VPN, and office productivity app and replaces its core code with a trojanized version. On Linux, it downloads a binary payload to /tmp, runs it as a detached process, and deletes the file from disk after it’s loaded into memory. On macOS, it inserts a malicious background script into ~/.zshrc and sets up a 10-minute Launch Agent. The final payload is a complex backdoor equipped with comprehensive command execution, arbitrary file upload and download, host reconnaissance, payload staging, and lateral movement capabilities. It also has the capacity to persist by injecting malicious code into common enterprise collaboration applications like DingTalk, Wukong, and Qoder. Exactly who is behind the campaign is unknown, but the presence of Chinese language comments in the source code, combined with the fact that GitHub commits are timestamped with the UTC+08:00 offset, indicates that it’s possibly the work of a Chinese-speaking threat actor going after Chinese-speaking developers using tools belonging to Alibaba Group. “The goal of the campaign seems to be industrial espionage,” Zanki noted. “While the number of downloads for the malicious packages is not significant, the impact of the campaign is hard to evaluate, because of the targeted nature and lateral-spread capabilities of the final-stage payload.” The complete set of packages associated with the campaign is below – lib-mtop aone-kit aone-kit-cli aone-sandbox local-config-parser smart-config-manager cloud-config-fetcher fast-transform-pipeline aone-cloud-cli colder-cli def-open-client feedback-ai-sdk flight-compare-analyzer lwp-web-client lzd-unified-station-sdk open-worker-cli test-skill-zip uniapi-bridge Users who have installed any of the above packages should assume compromise, rotate sensitive credentials from a clean machine, and audit developer systems for signs of suspicious activity. The disclosure comes as unknown threat actors published a poisoned version of mrmustard (0.7.4), the photonic quantum computing Python library from Xanadu, to run an information stealer capable of harvesting SSH private keys, AWS credentials, and Kubernetes configurations, and exfiltrating them to an attacker server (“metrics.femboy[.]energy”). According to StepSecurity , the payload runs on every package import. Further analysis indicates that the primary maintainer’s GitHub account was breached to push the rogue version by probing the project’s self-hosted CI runners and exfiltrating its publishing secrets to a webhook[.]site URL. The malware “had three separate persistence mechanisms installed that keep a stealer running long after the package is uninstalled,” SafeDep said . “The credential theft targets research and HPC environments, collecting SLURM job queues and GPU inventories alongside the usual cloud secrets.” Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post. SHARE Tweet Share Share Share Share on Facebook Share on Twitter Share on Linkedin Share on Reddit Share on Hacker News Share on Email Share on WhatsApp Share on Facebook Messenger Share on Telegram SHARE Credential Theft , Developer Security , linux , macos security , Malware , Open Source , Package Security , Remote Access Trojan , Software Supply Chain , Windows Security ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured Resources [Webinar] How Militaries Can Trust the Data Behind Autonomous Missions Download the 5-Step Action Plan for AI-Speed Exploitation Get the Checklist for Gaining Control of AI Use Across Your Organization Get the 2026 CISO Benchmark Report Based on 600 Security Leaders Cybersecurity Webinars Risk in AI-Generated Code How to Secure AI Code Before It Reaches Production Learn how 300 enterprise leaders are managing AI-driven open-source risk, remediation debt, and governance at scale. Register Build AI Securely How to Secure AI-Built Software at Machine Speed Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed. Register ⚡ Latest News Cybersecurity Resources 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Burp, sqlmap, SSRF, XXE, SSTI: Web Exploitation, Hands-On 35 labs plus a live CTF take you from recon to remote code execution. GWAPT prep, SANS CDI in D.C. SANS AI Cybersecurity Summit Returns This November Learn how practitioners are applying AI to today’s cybersecurity challenges. Expert Insights Articles Videos How AI-Assisted Attacks Are Breaking Legacy SIEM Tools August 3, 2026 Read ➝ A Look Inside Lasso’s AI Security Platform July 27, 2026 Read ➝ Claude Runs Across Six Surfaces in Your Company. Your Security Team Sees One. July 27, 2026 Read ➝ How to Make Social Engineering Unprofitable July 22, 2026 Read ➝ Get the Latest News in Your Inbox Get the latest news, expert insights, exclusive resources, and strategies from industry leaders, all for free. Email
Menu
