Security firm Socket has uncovered 18 malicious npm packages that impersonate Alibaba developer tools and deliver a cross-platform remote access trojan, in a supply-chain campaign that one researcher assesses as industrial espionage. The packages mirror the names of private, @ali-scoped Alibaba packages so that dependency resolution proceeds normally in environments that legitimately access those internal tools, with the malicious code hidden inside innocuous-looking wrappers.
How the lib-mtop Account Chain Delivers a Cross-Platform RAT
The campaign centers on “lib-mtop,” an unscoped package matching the name of a private @ali-scoped Alibaba package. The account first published it in November 2023 with no functionality and then uploaded three malicious versions in March and April. The maintainer account behind the packages now returns not-found on npmjs.com, and Socket said it is unclear whether the account was taken over or the developer went rogue.
Empty Wrappers and a Middle-Layer Bridge Mask the Malicious Loader
The same account published four companion packages: aone-kit, aone-kit-cli, aone-sandbox, and local-config-parser. The first three are empty wrappers impersonating private @ali packages, while local-config-parser is a legitimate JSON parser whose dependencies chain into an advanced RAT. The new lib-mtop versions include a loader that fetches and executes a remote JavaScript payload via curl. Up to 10 top-layer lure packages depend on “smart-config-manager,” a middle-layer bridge connecting to packages containing loader logic. A low-layer package contacts a GitHub repository for a rule-engine configuration that executes a malicious payload, which then contacts a remote server for secondary malware. The final payload is downloaded from a domain masquerading as Alibaba, aone-cli-next.oss-cn-beijing.aliyuncs[.]com.
Per-Platform Behavior on Windows, Linux, and macOS
The final-stage backdoor behaves differently by operating system. On Windows it terminates Alibaba’s Alilang enterprise security, VPN, and office application and replaces it with a trojanized version. On Linux it downloads a binary to /tmp, runs it detached, and deletes it from disk after loading it into memory. On macOS it inserts a malicious background script into ~/.zshrc and sets up a Launch Agent configured to run every 10 minutes.
What the Backdoor Can Do Once Installed
The backdoor provides command execution, file upload and download, host reconnaissance, payload staging, and lateral movement, and it persists by injecting into collaboration applications including DingTalk, Wukong, and Qoder. That combination of full remote control and persistence inside enterprise collaboration tools points to an operator interested in sustained access inside Alibaba-linked organizations rather than one-off data theft.
Chinese-Language Signals and an Industrial-Espionage Assessment
Attribution remains unresolved, but the source code contains Chinese-language comments and the GitHub commit timestamps sit in the UTC+08:00 timezone, which suggests a Chinese-speaking actor targeting Chinese-speaking developers. Zanki said the goal of the campaign appears to be industrial espionage and noted that while download counts are low, the campaign’s targeted nature and lateral-spread capabilities make the actual impact hard to evaluate.
Response and the Dormant-Account Question
Socket disclosed the full 18-package set and advised anyone who installed the affected packages to assume compromise, rotate sensitive credentials from a clean machine, and audit developer systems for suspicious activity. The campaign follows a pattern of attackers planting decoy packages that resolve cleanly in enterprise environments, where the private package names they imitate are normally available.
The uncertainty over whether the lib-mtop account was hijacked or turned malicious is itself a warning for registry operators: a package that sat benign for more than two years is exactly the kind of asset a supply-chain actor would want to acquire or poison. The long runway from publication to weaponization mirrors the pattern of accounts that build history before being abused, and it raises the question of how many other dormant, high-trust package names are waiting for the same treatment.
The backdoor’s integration into DingTalk, Wukong, and Qoder places the implant inside the same applications employees use daily, a placement suited to sustained collection rather than quick monetization. For Alibaba-linked engineering teams, the practical consequence of Socket’s disclosure is that any machine that installed the affected packages must be treated as compromised at the dependency level, and the credentials that flow through developer tooling need to be rotated from clean systems before normal work resumes.
