Benign-looking npm packages split malicious functionality across a dependency chain that deploys a cross-platform RAT targeting Alibaba developers.

Published:

28 juli 2026 om 20:23:55

Alert date:

28 juli 2026 om 23:04:30

Source:

socket.dev

Supply Chain & Dependencies, Ransomware & Malware, Data Breach & Exfiltration, Web Technologies

A cluster of malicious npm packages was discovered distributing a cross-platform Remote Access Trojan (RAT) targeting developers working with Alibaba Group internal tools. The campaign used a multi-layered dependency chain where individual packages appeared benign but combined to deliver loader functionality. The attack impersonated private @ali-scoped npm packages and used a Node.js vm sandbox escape technique to execute malicious payloads. The final payload, named aone-cli, is a fully-featured RAT supporting command execution, file exfiltration, screenshots, reverse TCP proxy, and lateral movement via DingTalk. Persistence mechanisms differ per OS: macOS uses Launch Agents, Windows trojans the Alilang app, and Linux runs a binary from /tmp. The campaign also poisons AI collaboration tools like DingTalk, Wukong, and Qoder by injecting Python scripts. Infrastructure was hosted on Alibaba Cloud to blend with legitimate traffic, and code comments in Chinese with UTC+8 timestamps suggest a Chinese-speaking threat actor. The campaign remained undetected for over 3 months and appears aimed at industrial espionage against Alibaba Group employees.

Technical details

A targeted multi-stage supply chain attack was conducted via malicious npm packages impersonating private @ali-scoped Alibaba packages. The campaign distributed loader malware functionality across several npm packages to evade detection, with individual packages appearing benign in isolation. The attack chain: (1) Top-layer lure packages (10 total) impersonate @ali-scoped private packages and depend on a middle-layer package 'smart-config-manager'. (2) smart-config-manager depends on 'cloud-config-fetcher' and 'local-config-parser'. (3) cloud-config-fetcher downloads a malicious configuration (preferences.json) from an attacker-controlled GitHub repository. (4) local-config-parser reads the config and evaluates rules using Node.js vm module - a vm sandbox escape technique is used via items.constructor.constructor to get reference to the global Function constructor, then calling F('return process')() to gain full host access. (5) A third-stage payload (setting.js) is downloaded from Alibaba Cloud OSS (aone-cli-next.oss-cn-beijing.aliyuncs.com) to blend with legitimate traffic. (6) setting.js performs platform fingerprinting and downloads the final cross-platform RAT ('aone-cli') with platform-specific persistence: macOS injects into ~/.zshrc and sets up a 10-minute Launch Agent; Windows kills the Alilang security app and replaces app.asar with a trojanized copy; Linux downloads binary to /tmp, runs detached, and deletes from disk. The final RAT supports commands including info, sleep, pwd, whoami, ipconfig/ifconfig, dir/ls, cat, read, screenshot, download, upload, pull, execute, run_python, proxy, aisearch, install_python_module, install_node_module, aipoison, aipoison_inject, aipoison_deploy, dws_lateral, and exit, with unknown commands forwarded to the OS shell. The RAT also poisons AI tools (DingTalk, Wukong, Qoder) by injecting Python code into .skills directories. C2 traffic is camouflaged using fake Origin and Referer headers set to https://alidocs.dingtalk.com. Code is heavily commented in Chinese and GitHub commits are timestamped UTC+0800. Campaign remained undetected for over 3 months. The lib-mtop package (originally published 3 years ago) had 3 new versions published end of March 2026, suggesting maintainer account takeover. Campaign staging occurred April 27-28 across multiple newly created npm publisher accounts.

Mitigation steps:

1. Treat any environment that installed affected packages as potentially compromised. Perform remediation from a clean machine, not from the potentially infected host. 2. Preserve forensic artifacts before cleanup where possible. 3. Identify every developer machine that installed any of the affected npm packages. 4. Remove all affected packages from affected environments. 5. Rotate all secrets exposed to affected environments from a clean machine, including: npm, GitHub, PyPI, RubyGems, cloud, Vault, Kubernetes, Docker, SSH, Slack, Twilio, and CI/CD secrets. 6. Audit developer machines for Python files containing the injection marker '# __INJECT_MARKER__' especially within .skills directories of DingTalk, Wukong, and Qoder tools. 7. Monitor network traffic for connections to C2 domains: xemzqli2vu[.]ai-app[.]pub and diamond-cli-znsxphqell[.]cn-shanghai[.]fcapp[.]run. 8. Review HTTP traffic for requests with Origin and Referer headers set to https://alidocs.dingtalk.com as this indicates C2 communication camouflage. 9. Search for environment variable ROBOT_UID with value 3201d407b7899a12d6d439950511c6a5 on developer machines. 10. Review DingTalk activities for signs of lateral movement originating from compromised machines. 11. Scan for the malicious payload file hashes listed in the IOCs. 12. Check ~/.zshrc on macOS for malicious background script injections. 13. On Windows, verify integrity of Alilang app.asar file. 14. Implement dependency confusion protections by ensuring private @ali-scoped packages are not resolvable via public npm registry.

Affected products:

npm packages: lib-mtop
aone-kit
aone-kit-cli
aone-sandbox
local-config-parser
smart-config-manager
cloud-config-fetcher
fast-transform-pipeline
aone-cloud-cli
colder-cli
def-open-client
feedback-ai-sdk
flight-compare-analyzer
lwp-web-client
lzd-unified-station-sdk
open-worker-cli
test-skill-zip
uniapi-bridge
node-data-utils
Alibaba Aone (internal R&D platform used by Taobao
Tmall Group
Alibaba Cloud)
Alilang (Alibaba security application - Windows)
DingTalk enterprise collaboration tool
Wukong enterprise collaboration tool
Qoder enterprise collaboration tool
macOS
Windows
Linux systems where affected packages are installed

Related CVE's:

Related threat actors:

Unknown Chinese-speaking threat actor (suspected based on Chinese code comments and UTC+0800 timezone git commits); npm accounts: ch4ce

neural_dev

tensor_lab

luck_show

aone_code; GitHub account: smi1e2u

IOC's:

lib-mtop (malicious npm package), aone-kit (malicious npm package), aone-kit-cli (malicious npm package), aone-sandbox (malicious npm package), local-config-parser (malicious npm package), smart-config-manager (malicious npm package), cloud-config-fetcher (malicious npm package), fast-transform-pipeline (malicious npm package), aone-cloud-cli (malicious npm package), colder-cli (malicious npm package), def-open-client (malicious npm package), feedback-ai-sdk (malicious npm package), flight-compare-analyzer (malicious npm package), lwp-web-client (malicious npm package), lzd-unified-station-sdk (malicious npm package), open-worker-cli (malicious npm package), test-skill-zip (malicious npm package), uniapi-bridge (malicious npm package), SHA256: 84a6ccaaab1596139d28e822f40cc99c68d337d4c81d1c6d9692c1d6bb22e4af - preferences.json (malicious config with second stage loader), SHA256: 6044974c633b3a319c31bb32110411520c425e89722a64806528553227e7a50a - setting.js (third-stage loader), SHA256: 0910ecfa049738ef3f2540855341a380df89224ff71da94b4c21689fd66f62e3 - aone-cli.js (macOS payload), SHA256: b8b81af76163bdcc5b4f7d8fe6795f164991f8a62678c971db031b9e90a27813 - aone-cli (Linux payload), SHA256: ef9a1896eeaae929800eade768276e2240ef252d26d0d96c1950a1a5e1aadb34 - aone-cli.zip (Windows payload), SHA256: e5d8350f1540fe91145dc262c455bca7748ad97dafb2d9facd5adebed9f66d2d - aone-cli-deps.tar.gz, SHA256: 41957bd0ba2d9c07af2e069f10780fdf6b2102c065bebe0db2136dfe07d67a28 - crypto.js (third-stage loader from lib-mtop), SHA256: 33b58598eb317553942e27545982d4c25ce6120eae10e42393746eb0e02ecae9 - aone-kit-update (Linux, from lib-mtop), C2 domain: xemzqli2vu[.]ai-app[.]pub, C2 domain: diamond-cli-znsxphqell[.]cn-shanghai[.]fcapp[.]run (reverse-proxy WebSocket C2), URL: hxxps://aone-cli-next[.]oss-cn-beijing[.]aliyuncs[.]com/config/setting.js, URL: hxxps://aone-ai-cli[.]oss-cn-beijing[.]aliyuncs[.]com/app/release/aone-cli.js, URL: hxxps://aone-ai-cli[.]oss-cn-beijing[.]aliyuncs[.]com/app/release/aone-cli-deps.tar.gz, URL: hxxps://aone-ai-cli[.]oss-cn-beijing[.]aliyuncs[.]com/app/release/aone-cli, URL: hxxps://aone-ai-cli[.]oss-cn-beijing[.]aliyuncs[.]com/app/release/aone-cli.zip, URL: hxxps://aone-kit[.]oss-cn-beijing[.]aliyuncs[.]com/plugins/crypto.js, URL: hxxps://aone-kit[.]oss-cn-beijing[.]aliyuncs[.]com/aone-kit-update/aone-kit.js, URL: hxxps://aone-kit[.]oss-cn-beijing[.]aliyuncs[.]com/aone-kit-update/app.asar, URL: hxxps://aone-kit[.]oss-cn-beijing[.]aliyuncs[.]com/aone-kit-update/aone-kit-update, GitHub account: smi1e2u (malicious maintainer), GitHub repo: hxxps://raw[.]githubusercontent[.]com/smi1e2u/smart-config-manager/main/defaults/preferences.json, Code indicator: # __INJECT_MARKER__ (Python injection marker in .skills directories), Environment variable: ROBOT_UID = 3201d407b7899a12d6d439950511c6a5, HTTP header indicator: Origin/Referer set to https://alidocs.dingtalk.com in C2 traffic, File: .cloud-preferences.json (malicious config dropped on disk)

This article was created with the assistance of AI technology by Perceptive.