**Supply Chain Attack: Malicious npm Packages Target Alibaba Developer Tools**
Cybersecurity researchers have uncovered a sophisticated software supply chain attack leveraging malicious npm packages to target users of Alibaba developer tools. The campaign delivers a cross-platform remote access trojan (RAT), specifically designed to compromise Chinese-speaking development environments.
**The Attack Mechanism**
At the heart of the campaign is a package named “lib-mtop.” This package is named identically to a private Alibaba package under the “@ali” scope. Although initially published in November 2023 with benign functionality, three malicious versions (v1.0.1, v1.0.2, and v1.0.3) were uploaded in March and April. Security firm Socket analysis indicates that a maintainer account, “ch4ce,” was likely compromised or went rogue. This account is responsible for publishing the malicious packages, including “aone-kit,” “aone-kit-cli,” “aone-sandbox,” and “local-config-parser.”
The attack operates through a complex, multi-layered dependency tree. Top-layer “lure” packages impersonate private @ali-scoped packages. When a developer installs one of these, the dependency resolution process pulls in hidden, malicious dependencies. These low-layer packages include a configuration parser that fetches a remote JavaScript payload using `curl`.
**Execution and Payload Delivery**
The malicious loader is embedded across multiple packages, designed to activate when the dependency tree is installed in an environment with access to the spoofed private packages. The final payload is fetched from a domain masquerading as Alibaba—”aone-cli-next.oss-cn-beijing.aliyuncs[.]com”—to avoid detection.
The payload is a sophisticated backdoor whose behavior varies by the victim’s operating system:
* **Windows:** It terminates security and productivity applications like Alilang, VPN clients, and office software, replacing their core code with a trojanized version.
* **Linux:** It downloads a binary to `/tmp`, executes it as a detached process, and then deletes the file to hide its tracks.
* **macOS:** It inserts a malicious background script into the user’s `~/.zshrc` file and establishes a Launch Agent for persistence.
This final backdoor is highly versatile, offering command execution, file upload/download, host reconnaissance, lateral movement, and the capability to inject malicious code into popular enterprise applications such as DingTalk, Wukong, and Qoder to ensure persistence.
**Attribution and Impact**
The campaign exhibits hallmarks of a Chinese-speaking threat actor, evidenced by Chinese language comments in the source code and GitHub commits timestamped with the UTC+08:00 offset. The primary goal appears to be industrial espionage. While the number of downloads for the malicious packages remains low, the targeted nature of the attack and the advanced lateral-spread capabilities of the payload make the impact difficult to fully assess.
**Affected Packages**
The complete list of identified malicious packages associated with this campaign includes:
* lib-mtop
* aone-kit
* aone-kit-cli
* aone-sandbox
* local-config-parser
* smart-config-manager
* cloud-config-fetcher
* fast-transform-pipeline
* aone-cloud-cli
* colder-cli
* def-open-client
* feedback-ai-sdk
* flight-compare-analyzer
* lwp-web-client
* lzd-unified-station-sdk
* open-worker-cli
* test-skill-zip
* uniapi-bridge
**Conclusion**
This supply chain attack represents a significant threat to developers within the Alibaba ecosystem. By hijacking the trust associated with private, scoped packages, the attackers were able to distribute a powerful and flexible RAT. The campaign underscores the critical need for developers to verify the integrity of their dependencies, monitor for unauthorized changes in account privileges, and audit their systems for suspicious activity, especially if they have installed any of the packages listed above.
—
### FAQ
**Q1: How did the attackers compromise the npm packages?**
A: The attackers likely compromised the maintainer account “ch4ce” to push the malicious versions of the packages. In a separate, related incident highlighted in the article, another package (`mrmustard`) was poisoned by breaching the maintainer’s GitHub account to steal publishing secrets.
**Q2: Which packages should I check for in my `node_modules`?**
A: You should check if you have any of the following packages installed: `lib-mtop`, `aone-kit`, `aone-kit-cli`, `aone-sandbox`, `local-config-parser`, `smart-config-manager`, and the other listed packages. If any are present, assume your system is compromised.
**Q3: What should I do if I find one of these packages installed?**
A: If you find any of the listed packages installed, you should immediately rotate all sensitive credentials from a clean machine and audit your developer systems for any signs of suspicious activity.
**Q4: Is this attack limited to macOS and Linux?**
A: No, the attack is cross-platform. It includes payloads for Windows, Linux, and macOS, making it a significant threat regardless of the developer’s operating system.
**Q5: What is the goal of this campaign?**
A: According to security researchers, the primary goal of this campaign is industrial espionage, targeting developers who are likely working for companies within the Alibaba Group.
—
**Conclusion**
This sophisticated supply chain attack serves as a stark reminder of the vulnerabilities within the open-source ecosystem. By impersonating legitimate, private Alibaba packages, the attackers successfully tricked developers into installing a complex, multi-stage malware suite. The campaign’s cross-platform capability and advanced persistence mechanisms highlight the need for heightened vigilance. Developers must actively manage their dependencies, verify the integrity of package sources, and regularly audit their systems to detect and mitigate such targeted threats.
