"The goal of the campaign seems to be industrial espionage," Socket security researcher Karlo Zanki noted.
Scope: 18 malicious npm packages and a targeted supply-chain aim
Researchers have identified 18 malicious npm packages designed to deliver a cross-platform remote access trojan (RAT) to users of Alibaba developer tools, in a targeted supply-chain operation focused on Chinese-speaking environments. The full set of packages associated with the campaign includes lib-mtop, aone-kit, aone-kit-cli, aone-sandbox, local-config-parser, smart-config-manager, cloud-config-fetcher, fast-transform-pipeline, aone-cloud-cli, colder-cli, def-open-client, feedback-ai-sdk, flight-compare-analyzer, lwp-web-client, lzd-unified-station-sdk, open-worker-cli, test-skill-zip, and uniapi-bridge.
How the packages impersonate Alibaba private packages
The attackers leveraged a pattern of impersonation and dependency chaining. Top-layer lure packages reused names of private @ali-scoped packages; one unscoped package, lib-mtop, shares its name with a private @ali package. According to Zanki, the first three packages published by the maintainer account "ch4ce" are empty wrappers that declare private @ali-scoped packages as dependencies, acting as decoys that trigger installation of an additional dependency tree. When these decoys are installed in environments that can resolve the impersonated scoped packages, the dependency resolution proceeds as expected while also pulling in extra, malicious dependencies.
Built by Nubivance.
OSINTSights' secure edge-first architecture, AI content pipeline, and serverless ops are designed by Nubivance. We do this for clients too.
Talk to us →Technical tradecraft: loaders, a vm-based rule engine, and OS-specific payloads
The malicious activity was split across multiple packages so that loader functionality is embedded in low-layer components and activated via a middle-layer bridge component named smart-config-manager. One low-layer package contacts a GitHub repository to retrieve a rule engine configuration, then uses the Node.js vm module to implement a final-phase execution policy and to decide which payload to download based on the victim's operating system.
The secondary payload is fetched from a domain that attempts to blend in with Alibaba infrastructure: aone-cli-next.oss-cn-beijing.aliyuncs[.]com. The campaign's OS-specific behaviors include:
- Windows: terminate Alilang enterprise security, VPN, and office productivity app processes and replace core code with a trojanized version;
- Linux: download a binary to /tmp, run it as a detached process, and delete the file after loading it into memory;
- macOS: insert a malicious background script into ~/.zshrc and install a Launch Agent that runs on a 10-minute interval.
The final-stage payload is a feature-rich backdoor with command execution, arbitrary file upload and download, host reconnaissance, payload staging, lateral movement capabilities, and persistence via injection into enterprise collaboration applications such as DingTalk, Wukong, and Qoder.
Evidence and likely intent
Analysts noted Chinese-language comments in the source code and GitHub commits time-stamped with the UTC+08:00 offset, which together suggest a Chinese-speaking threat actor and a focus on Chinese-speaking developers using Alibaba tools. Socket's analysis characterizes the campaign's goal as industrial espionage; Zanki warned that the targeted nature and lateral-spread capabilities make the campaign's true impact difficult to evaluate despite relatively low download counts.
What this means for Alibaba developer-tool users, open-source maintainers, and security teams
Users who have installed any of the 18 listed packages should assume compromise, rotate sensitive credentials from a clean machine, and audit developer systems for suspicious activity, Socket advised. For open-source maintainers, the campaign demonstrates how unscoped or impersonating packages can be used as decoys to pull in malicious dependency trees. Security teams should watch dependency resolution behavior in environments that access private package registries and monitor for unusual GitHub repository fetches and vm-executed rule engines.
Context: concurrent supply-chain incidents and persistence concerns
The disclosure arrives alongside other recent supply-chain abuse: an unknown actor published a poisoned version of the Xanadu photonic quantum computing Python library mrmustard (0.7.4) that ran an information stealer capable of harvesting SSH private keys, AWS credentials, and Kubernetes configurations and exfiltrating them to metrics.femboy[.]energy. StepSecurity reported that the mrmustard malicious payload executed on every import and that the package maintainer's GitHub account was breached by probing self-hosted CI runners and exfiltrating publishing secrets. SafeDep found three separate persistence mechanisms in that campaign, noting credential theft targeting research and HPC environments.
Exactly who is behind the Alibaba-targeted npm campaign remains unknown. The combination of impersonation, a vm-based rule engine, multi-stage payloads, OS-specific weaponization, and persistence through enterprise collaboration apps indicates a deliberate operation built to reach selected developer systems and to move laterally once a foothold is achieved. That targeted profile — and Zanki's assessment of an industrial-espionage aim — leave one clear, concrete question: which development workspaces resolved the impersonated @ali packages and thus allowed the malicious dependency chains to execute?
