18 malicious npm packages have been used in a tightly coordinated software supply chain attack to deliver a cross‑platform RAT that specifically targets developers working with Alibaba’s internal Aone tooling and @ali-scoped packages.
The operation came to light after researchers analyzed a seemingly simple malicious npm package, lib-mtop, which acted as a downloader and exposed a broader, structured dependency-chain attack.
Although lib-mtop was originally published around three years ago with a single inert version, three new versions pushed in late March 2026 transformed it into a malicious loader.
The package impersonates an unscoped clone of a private @ali namespace library, a naming convention widely used in internal Alibaba projects and tooling referenced across GitHub.
The full malicious cluster comprises 18 packages: lib-mtop, aone-kit, aone-kit-cli, aone-sandbox, local-config-parser, smart-config-manager, cloud-config-fetcher, fast-transform-pipeline, aone-cloud-cli, colder-cli, def-open-client, feedback-ai-sdk, flight-compare-analyzer, lwp-web-client, lzd-unified-station-sdk, open-worker-cli, test-skill-zip, and uniapi-bridge.
Many of these names shadow private @ali-scoped packages, ensuring that in environments with access to Alibaba-private registries, dependency resolution appears legitimate while silently pulling in attacker-controlled modules.
The campaign distributes its loader functionality across multiple ostensibly benign packages arranged in a three-tier dependency tree.
The top-layer “lure” packages (including aone-kit, aone-kit-cli, aone-sandbox, and several aone-* and client-* modules) provide little or no real functionality but depend on both private @ali packages and a central middle-layer package named smart-config-manager.
This middle layer, in turn, defines dependencies on cloud-config-fetcher and local-config-parser, which implement configuration retrieval and rule evaluation respectively.
Time-correlation of account creation and publishing activity suggests coordinated staging between April 27 and 28, 2026: node-data-utils and fast-transform-pipeline appear to have been used as test vehicles for the multi-package loader delivery.
While smart-config-manager and its dependent modules were pushed on April 28 from multiple newly created npm accounts.
The local-config-parser package, however, was published under an older account, ch4ce, indicating either an account takeover or an insider going rogue, though the precise origin remains unconfirmed.
Both cloud-config-fetcher and local-config-parser genuinely implement their advertised logic fetching configuration and evaluating rules via Node.js’ vm module making them appear benign on casual inspection.
On installation, cloud-config-fetcher auto-initializes by downloading a default JSON configuration from an attacker-controlled GitHub repository and writing it to a hidden file, .cloud-preferences.json, on disk.
Socket Researchers said that, the campaign remained undetected for over three months and demonstrates a highly tailored industrial espionage operation against Chinese‑speaking development environments.
Local-config-parser’s auto-init logic then reads this same file, parses the rules it contains, and executes them within a vm sandbox, creating a seemingly legitimate download-and-execute configuration pattern anchored on GitHub.
The malicious logic is embedded inside these configuration rules, camouflaged by wrapping it with benign-looking expressions such as multiplier-based transformations of items for different categories.
To break out of the vm isolation, the code uses a classic Node.js sandbox escape by deriving the global Function constructor from the items object (for example, var F = items.constructor.constructor; var p = F(‘return process’)();) to regain access to the process object.
Once outside the sandbox, it attempts multiple methods via process.getBuiltinModule, process.mainModule, or searches through global to reach require or _load, ultimately loading the http module to download and execute a third-stage setting.js payload from an attacker-controlled C2 server hosted on Alibaba Cloud infrastructure.
The third-stage setting.js script performs host reconnaissance, OS fingerprinting, and then retrieves a fourth-stage aone-cli payload tailored to the victim’s platform, establishing persistence in OS-specific ways.
On macOS, it plants a malicious background script via ~/.zshrc and a Launch Agent with a ten-minute interval; on Windows, it attempts to kill the official Alilang security application and replace its app.asar core with a trojanized version; on Linux.
Across platforms, it also silences local logging and removes intermediate artifacts to hinder forensic reconstruction.
The final aone-cli payload is a fully featured cross-platform RAT tightly aligned with Alibaba’s internal R&D environment, particularly Aone, which underpins key workflows for Taobao & Tmall Group and Alibaba Cloud.
Supported capabilities include arbitrary command execution, file upload and download, system reconnaissance, multi-stage payload management.
An encrypted reverse TCP proxy, and application-specific persistence via code injection, including lateral movement using DingTalk and other Chinese enterprise collaboration tools.
The RAT automatically beacons to a hardcoded C2 endpoint, polling for commands, and exposes a structured command set (such as info, pwd, screenshot, download, proxy, run_python, install_node_module, aipoison, and dws_lateral), while forwarding any unrecognized instructions directly to the OS shell.
Persistence mechanisms further poison AI-oriented tools by injecting Python snippets into .skills directories, ensuring that a malicious script.js is launched via the Bun runtime whenever these tools execute, with comments and markers in Chinese aimed at facilitating idempotent injection.
Network traffic towards the C2 server is disguised using fake Origin and Referer headers pointing to alidocs.dingtalk.com, blending in with legitimate traffic to official DingTalk documentation domains.
The codebase is heavily commented in Chinese, and GitHub commits related to the malicious rules and payloads are timestamped in UTC+0800 (China Standard Time) and align closely with the creation times of the npm packages.
| # | Package name |
|---|---|
| 1 | lib-mtop |
| 2 | aone-kit |
| 3 | aone-kit-cli |
| 4 | aone-sandbox |
| 5 | local-config-parser |
| 6 | smart-config-manager |
| 7 | cloud-config-fetcher |
| 8 | fast-transform-pipeline |
| 9 | aone-cloud-cli |
| 10 | colder-cli |
| 11 | def-open-client |
| 12 | feedback-ai-sdk |
| 13 | flight-compare-analyzer |
| 14 | lwp-web-client |
| 15 | lzd-unified-station-sdk |
| 16 | open-worker-cli |
| 17 | test-skill-zip |
| 18 | uniapi-bridge |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
$1M Data Breach Warranty is Genuine Protection?: Download 10 Point Free AI SOC Breach Warranty Guide
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…