Cybersecurity researchers uncovered malicious npm packages designed to target developers who use Alibaba developer tools. The campaign is built like a software supply-chain attack: it hides a cross-platform remote access trojan (RAT) inside a dependency chain, activates when specific packages are installed, and ultimately delivers follow-on malware.
While the precise perpetrators remain unknown, the evidence points toward a threat actor focused on Chinese-speaking environments. Indicators include Chinese language comments in the code and commit timestamps aligned with UTC+08:00.
How the malicious npm packages reached victims
The attack centers on npm packages that were published or updated over time and then modified to include a hidden loader. One example is an unscoped package named lib-mtop. It originally appeared on npm around November 2023 with no functionality, but new versions were uploaded in March and April (v1.0.1, v1.0.2, and v1.0.3).
At the moment of analysis, it was unclear whether this change resulted from a maintainer account takeover or from the project developer intentionally turning rogue. Regardless of the cause, the newer versions added a loader component whose job is to fetch a remote JavaScript payload using curl and execute it.
Decoy packages impersonating private dependencies
A key feature of the intrusion is how it disguises its malicious behavior. Researchers noted that the same maintainer account associated with the suspicious activity also published additional packages, including aone-kit, aone-kit-cli, aone-sandbox, and local-config-parser.
According to analysis shared by a security researcher, the first three packages act as empty wrappers. They carry the same names as private packages that exist under an @ali scope, and they list these private packages as dependencies in their package.json files. This approach increases the odds that the dependency resolver will behave as expected while still allowing extra malicious components to be delivered.
The local-config-parser package is more subtle. On its face, it implements a legitimate JSON configuration file parser. However, the package’s dependencies—each apparently benign on its own—become dangerous when combined into the full dependency tree used by the campaign.
The loader chain and conditional payload delivery
The malicious behavior is distributed across several layers. Researchers described the “top-layer” lure packages as decoys that activate installation of a larger dependency graph. They do not necessarily contain the payload logic themselves; instead, they pull in intermediate and low-layer packages that include the loader functionality.
In findings, up to 10 lure packages were observed to depend on smart-config-manager. This module functions as a bridge that connects the initial lure packages to the deeper malicious packages that contain the loader logic.
One lower-layer component proceeds to contact a GitHub repository to retrieve and store a “rule engine” configuration. Afterward, it uses that configuration to execute the malicious payload. The malware then contacts a remote server to fetch secondary malware, creating additional stages beyond the initial npm compromise.
Rule engine evasion and OS-specific actions
One notable aspect is how the final stage selects behaviors based on the victim’s operating system. The rule engine uses the vm module, enabling it to run logic for the last phase depending on the environment.
For payload retrieval, the campaign uses a domain that masquerades as Alibaba, specifically aone-cli-next.oss-cn-beijing.aliyuncs[.]com. This naming pattern is intended to blend in with expected infrastructure and avoid straightforward detection.
Once it reaches the OS-specific execution stage, the malware performs different actions:
- Windows: it terminates an enterprise security application (Alilang), a VPN component, and an office productivity app, then replaces the core code with a trojanized version.
- Linux: it downloads a binary payload into /tmp, runs it as a detached process, and deletes the file after loading it into memory.
- macOS: it inserts a malicious background script into ~/.zshrc and sets up a Launch Agent designed to run for about 10 minutes.
Beyond these steps, the final payload acts as a complex backdoor. Researchers described capabilities including comprehensive command execution, arbitrary file upload and download, host reconnaissance, payload staging, and lateral movement.
It can also persist by injecting malicious code into common enterprise collaboration applications such as DingTalk, Wukong, and Qoder. That persistence can extend the impact beyond the initial infection window.
Scope of the npm package set
Researchers listed the package set associated with the campaign. If your environment installed any of the items below, you should treat it as suspicious and investigate immediately:
- lib-mtop
- aone-kit
- aone-kit-cli
- aone-sandbox
- local-config-parser
- smart-config-manager
- cloud-config-fetcher
- fast-transform-pipeline
- aone-cloud-cli
- colder-cli
- def-open-client
- feedback-ai-sdk
- flight-compare-analyzer
- lwp-web-client
- lzd-unified-station-sdk
- open-worker-cli
- test-skill-zip
- uniapi-bridge
Why this looks like industrial espionage
Attribution is still unconfirmed. However, researchers believe the campaign’s goal is likely aligned with industrial espionage. Even if download counts appear low, the targeted nature of the dependency chain and the lateral-spread capabilities of the backdoor make the overall risk harder to quantify.
In other words, a smaller number of infected developer environments can still translate into meaningful exposure if the attackers are aiming for proprietary code, infrastructure access, or internal systems.
What to do if you installed these packages
If you installed any of the suspicious malicious npm packages listed above, researchers recommend responding as though compromise has occurred.
- Assume compromise and don’t rely on the current system state.
- Rotate sensitive credentials from a clean machine, including keys and tokens used for cloud and CI/CD workflows.
- Audit developer systems for signs of suspicious activity, especially unusual network connections, unexpected processes, and tampering with developer or collaboration software.
When investigating, focus on the full dependency history of the project, not only the direct package you remember installing. Supply-chain attacks often hide the true behavior deeper in transitive dependencies.
Additional supply-chain incident: poisoned Python package
The disclosure also mentioned another supply-chain case involving an altered Python library. Unknown threat actors published a poisoned version of mrmustard (0.7.4), a photonic quantum computing library from Xanadu, to run an information stealer.
This Python malware was reported to harvest sensitive material such as SSH private keys, AWS credentials, and Kubernetes configurations, then exfiltrate them to an attacker server. The payload reportedly runs on every package import, and analysis suggested multiple persistence mechanisms that keep the stealer active even after the package is uninstalled.
While this second incident targets a different ecosystem, it reinforces the same broader message: attackers continue to exploit developer tooling pipelines by hiding malicious behavior inside widely used dependencies.
Conclusion
The discovery of malicious npm packages delivering a cross-platform RAT shows how quickly supply-chain attacks can turn routine dependency installation into a full compromise path. By combining decoy packages, layered loaders, OS-specific execution, and persistence through enterprise applications, the campaign is built for impact rather than convenience.
If any of the listed packages were installed in your environment, treat it seriously: investigate the dependency tree, rotate credentials from a trusted machine, and audit for suspicious behavior across developer workstations and CI/CD systems.
Source: https://thehackernews.com/2026/08/18-malicious-npm-packages-deliver-cross.html
