Malicious npm Packages Deploy Cross-Platform RAT Targeting Alibaba Developers

A cluster of malicious npm packages has been used to deliver a cross-platform remote access trojan against developers who use Alibaba-related tools.

The campaign hides its harmful code across several packages, making each part look ordinary when viewed on its own.

The attack relies on package names that imitate private Alibaba packages and adds malicious dependencies during installation.

This approach can expose developer workstations, source code, credentials, and internal collaboration environments to remote control.

Researchers at Socket.dev identified the activity after examining the lib-mtop package, which had received new versions after years of little activity.

Socket.dev said in a report shared with Cyber Security News (CSN) that the operation appears narrowly focused rather than widely distributed.

Although the malicious packages recorded limited downloads, the RAT’s ability to collect data, run commands, and move through DingTalk-related tools creates a potentially serious espionage risk for affected organizations.

Malicious npm Packages Deploy Cross-Platform RAT

The attackers used a layered dependency chain in which top-level lure packages copied the names of private packages under Alibaba’s ali scope.

When a developer installed one of these lookalikes, additional dependencies supplied the downloader and rule-processing components.

This technique reflects the wider risk seen in recent npm supply chain attacks, where a seemingly harmless dependency can become the entry point for a larger compromise.

The packages were published through different maintainer accounts, helping conceal their shared purpose.

The dependency chain fetched a configuration file from an attacker-controlled GitHub repository and saved it locally as .cloud-preferences.json.

A package named local-config-parser then evaluated the rules inside that file, allowing hidden code to run on the victim’s machine.

The malicious rule abused a known escape from Node.js virtual-machine isolation. It accessed the host process, recovered Node’s module-loading functions, and downloaded another payload from infrastructure hosted in Alibaba Cloud, likely to make malicious traffic appear less unusual.

The next stage profiles the host and selects a payload for macOS, Windows, or Linux.

On macOS, it adds persistence through .zshrc and a Launch Agent; on Windows, it replaces the app.asar file of the Alilang security application; on Linux, it runs a temporary binary in the background.

RAT Capabilities and Response

The final aone-cli payload is a remote access trojan built for systems connected to Alibaba’s internal development ecosystem.

It can execute shell commands, upload and download files, collect host details, stage additional payloads, and create an encrypted reverse TCP proxy.

Its focus on DingTalk, Wukong, and Qoder enterprise tools is particularly concerning.

The malware can alter Python scripts in application .skills directories so that a hidden script runs later, offering a route for persistence and lateral movement across developer environments.

This makes the campaign comparable to other developer-focused RAT malware campaigns, but its package impersonation and Alibaba-specific tooling suggest a more targeted objective.

The Chinese-language comments and China Standard Time commit metadata may point to a Chinese-speaking operator, though they do not establish attribution.

Teams that installed any listed package should treat the affected environment as compromised and begin remediation from a clean device.

They should preserve forensic evidence where possible, remove the packages, rotate exposed development and cloud secrets, and inspect Python files for the INJECTMARKER value.

Security teams should also identify every developer workstation that installed the affected dependencies, review suspicious DingTalk activity, and monitor for connections to the listed command-and-control infrastructure.

Reviewing requests that use forged DingTalk Origin and Referer headers can help uncover communications tied to this threat.

Organizations can reduce similar exposure by reviewing dependency changes before deployment and limiting package-install permissions in sensitive build environments.

Coverage of malicious package delivery methods and npm registry compromise incidents also underscores why developers must treat unexpected dependency updates as a security event.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
Malicious npm package	lib-mtop	Malicious downloader package
Malicious npm package	aone-kit	Top-layer lure package
Malicious npm package	aone-kit-cli	Top-layer lure package
Malicious npm package	aone-sandbox	Top-layer lure package
Malicious npm package	local-config-parser	Rule parser with malicious auto-initialization logic
Malicious npm package	smart-config-manager	Middle-layer dependency package
Malicious npm package	cloud-config-fetcher	Configuration-fetching dependency
Malicious npm package	fast-transform-pipeline	Testing and delivery package
Malicious npm package	aone-cloud-cli	Top-layer lure package
Malicious npm package	colder-cli	Top-layer lure package
Malicious npm package	def-open-client	Top-layer lure package
Malicious npm package	feedback-ai-sdk	Top-layer lure package
Malicious npm package	flight-compare-analyzer	Top-layer lure package
Malicious npm package	lwp-web-client	Top-layer lure package
Malicious npm package	lzd-unified-station-sdk	Top-layer lure package
Malicious npm package	open-worker-cli	Top-layer lure package
Malicious npm package	test-skill-zip	Top-layer lure package
Malicious npm package	uniapi-bridge	Top-layer lure package
GitHub account	smi1e2u	Malicious maintainer account
GitHub repository	fast-transform-pipeline	Testing repository
GitHub repository	smart-config-manager	Repository containing malicious configuration rules
SHA-256	84a6ccaaab1596139d28e822f40cc99c68d337d4c81d1c6d9692c1d6bb22e4af	preferences.json configuration file
SHA-256	6044974c633b3a319c31bb32110411520c425e89722a64806528553227e7a50a	setting.js third-stage loader
SHA-256	0910ecfa049738ef3f2540855341a380df89224ff71da94b4c21689fd66f62e3	aone-cli.js deployed on macOS
SHA-256	b8b81af76163bdcc5b4f7d8fe6795f164991f8a62678c971db031b9e90a27813	aone-cli deployed on Linux
SHA-256	ef9a1896eeaae929800eade768276e2240ef252d26d0d96c1950a1a5e1aadb34	aone-cli.zip deployed on Windows
SHA-256	e5d8350f1540fe91145dc262c455bca7748ad97dafb2d9facd5adebed9f66d2d	aone-cli-deps.tar.gz older payload version
SHA-256	41957bd0ba2d9c07af2e069f10780fdf6b2102c065bebe0db2136dfe07d67a28	crypto.js third-stage loader
SHA-256	33b58598eb317553942e27545982d4c25ce6120eae10e42393746eb0e02ecae9	aone-kit-update Linux payload
C2 domain	xemzqli2vu.ai-app.pub	Primary command-and-control domain
C2 domain	diamond-cli-znsxphqell.cn-shanghai.fcapp.run	Reverse-proxy WebSocket command-and-control endpoint
Payload URL	hxxps://aone-cli-next.oss-cn-beijing.aliyuncs.com/config/setting.js	Third-stage loader delivery
Payload URL	hxxps://aone-ai-cli.oss-cn-beijing.aliyuncs.com/app/release/aone-cli.js	macOS payload delivery
Payload URL	hxxps://aone-ai-cli.oss-cn-beijing.aliyuncs.com/app/release/aone-cli-deps.tar.gz	Payload dependency archive
Payload URL	hxxps://aone-ai-cli.oss-cn-beijing.aliyuncs.com/app/release/aone-cli	Linux payload delivery
Payload URL	hxxps://aone-ai-cli.oss-cn-beijing.aliyuncs.com/app/release/aone-cli.zip	Windows payload delivery
Payload URL	hxxps://aone-kit.oss-cn-beijing.aliyuncs.com/plugins/crypto.js	lib-mtop payload delivery
Payload URL	hxxps://aone-kit.oss-cn-beijing.aliyuncs.com/aone-kit-update/aone-kit.js	Linux payload delivery
Payload URL	hxxps://aone-kit.oss-cn-beijing.aliyuncs.com/aone-kit-update/app.asar	Trojanized Windows application archive
Configuration indicator	INJECTMARKER	Marker used to identify injected Python code
Environment variable	ROBOTUID=3201d407b7899a12d6d439950511c6a5	Malware-related environment variable value

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

ALERT!: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.