Researchers at Socket have discovered 18 malicious npm packages targeting developers who use tools from the Alibaba Group ecosystem. The packages impersonate private components from the @ali namespace and deliver a cross-platform remote access trojan (RAT) with capabilities for command execution, file exfiltration and lateral movement. The attack affects Windows, Linux and macOS environments. Anyone who has installed the listed packages is advised to treat their system as compromised and immediately rotate credentials from a clean machine.
Attack mechanism: multi-stage dependency chain
According to Socket researcher Carlo Zanki, the key element of the campaign is the lib-mtop package, which shares its name with a private Alibaba package from the @ali scope. The package was first published in November 2023 with no functionality, but in March–April 2025 three new versions (v1.0.1, v1.0.2, v1.0.3) appeared, containing a loader that retrieves a remote JavaScript payload via curl and executes it.
The attack is built on a three-tier dependency architecture:
- Top layer (lure packages) — up to 10 packages that mimic private @ali components. These include aone-kit, aone-kit-cli and aone-sandbox, which, according to the researchers, are essentially empty wrappers that declare Alibaba private packages as dependencies.
- Middle layer (bridge) — the smart-config-manager package, on which the top-level packages depend and which connects them to the malicious components at the bottom layer.
- Bottom layer (loader) — components that connect to a GitHub repository to obtain the rule engine configuration, and then download and execute the malicious payload from a remote server.
The local-config-parser package warrants special attention: it implements a legitimate JSON configuration parser but includes dependencies that look harmless in isolation and together form a delivery channel for the RAT. All five initial packages were published under the ch4ce account, which currently returns a “not found” error on npmjs.com.
Cross-platform payload behavior
According to reports, the rule engine uses the Node.js vm module to determine the victim’s operating system and load the corresponding payload. The download is performed from a domain masquerading as Alibaba infrastructure.
The behavior varies by platform:
- Windows — terminates processes of the Alilang enterprise security application, VPN and office software, then replaces their core code with a trojanized version.
- Linux — downloads a binary to /tmp, launches it as a detached process and deletes the file from disk after it is loaded into memory.
- macOS — injects a malicious background script into ~/.zshrc and configures a Launch Agent with a 10-minute execution interval.
The final payload is a sophisticated backdoor capable of arbitrary command execution, file upload and download, host reconnaissance, staging additional payloads and lateral movement. According to the researchers, the backdoor can also establish persistence by injecting malicious code into enterprise collaboration applications — DingTalk, Wukong and Qoder.
Indicators of compromise
Domains associated with the campaign:
- aone-cli-next.oss-cn-beijing.aliyuncs[.]com — payload source masquerading as Alibaba infrastructure
Full list of malicious packages:
- lib-mtop, aone-kit, aone-kit-cli, aone-sandbox, local-config-parser
- smart-config-manager, cloud-config-fetcher, fast-transform-pipeline
- aone-cloud-cli, colder-cli, def-open-client, feedback-ai-sdk
- flight-compare-analyzer, lwp-web-client, lzd-unified-station-sdk
- open-worker-cli, test-skill-zip, uniapi-bridge
Threat context and attribution
The actor behind the campaign remains unknown. Researchers note that it is difficult to accurately assess the true scale of impact: although the number of downloads of the malicious packages is small, the targeted nature of the attack and the lateral spread capabilities of the final payload make the potential damage significant. It also remains unclear whether the ch4ce account was compromised or its owner deliberately published malicious code.
It is worth noting that this campaign is not an isolated case of supply chain attacks in package manager ecosystems. In parallel, StepSecurity reported the compromise of PyPI package mrmustard version 0.7.4 (a library for photonic quantum computing by Xanadu). Attackers compromised the GitHub account of the lead maintainer, broke in via self-hosted CI runners and published a version with a stealer targeting SSH keys, AWS credentials and Kubernetes configurations. According to SafeDep, the malicious code installed three separate persistence mechanisms that remained active even after the package was removed.
Recommendations
- Review dependencies — audit projects for any of the 18 listed packages in your dependency tree. Use
npm lsor software composition analysis (SCA) tools. - If found — assume compromise. Rotate all credentials (npm tokens, SSH keys, cloud secrets) from a known-clean machine.
- Check persistence mechanisms: on macOS — the ~/.zshrc file and Launch Agents; on Windows — the integrity of the Alilang installation and related enterprise software; on Linux — suspicious processes launched from /tmp.
- Configure scope policy — use .npmrc configuration to bind private scopes (@ali) to an internal registry to prevent dependency substitution from the public npm registry.
- Inspect enterprise applications DingTalk, Wukong and Qoder for unauthorized code modifications.
This campaign demonstrates the effectiveness of dependency confusion techniques combined with a multi-layer architecture where malicious logic is distributed across several seemingly benign packages. For organizations using private scoped npm packages, it is critical to bind scopes to internal registries via .npmrc and to implement automated dependency audits that block installation of public packages whose names collide with private components.
