18 Malicious npm Packages Target Alibaba Tooling Developers

Researchers at Socket have disclosed a targeted software supply-chain attack in which 18 malicious packages were uploaded to the npm registry. Their authors are hunting for developers who use Alibaba Group's internal tooling, and the campaign's ultimate goal, according to the researchers, is industrial espionage.

How the lure works

One of the key packages is lib-mtop: it reuses the name of a private Alibaba package from the @ali scope, but was published without that scoping. It first appeared back in November 2023 as an empty shell, and in March–April it received three new versions carrying a loader that pulls down remote JavaScript via curl and executes it. Whether the maintainer's account (ch4ce, now unavailable) was compromised or the developer acted on their own has not yet been established.

Some of the packages (aone-kit, aone-kit-cli, aone-sandbox) are empty wrappers that copy the names of private @ali packages and declare them as their own dependencies. The trick is that the malicious logic is split up and scattered across the dependency tree: on their own the individual packages look harmless, but assembled together they form a delivery channel for the trojan. Up to ten “decoy packages” drag in smart-config-manager, which serves as a bridge to the packages containing the loader.

The vm module and the Alibaba disguise

One of the lower-level packages reaches out to a GitHub repository for a “rules engine” configuration, and then, via the vm module and depending on the victim's OS, downloads a payload from a domain disguised as Alibaba's cloud (aone-cli-next.oss-cn-beijing.aliyuncs[.]com).

From there the behavior depends on the platform. On Windows the trojan terminates Alibaba's Alilang corporate security software, VPN and office applications, replacing their code with a trojanized version. On Linux the binary is written to /tmp, launched as a separate process, and immediately deleted from disk, remaining in memory. On macOS the malicious script is written into ~/.zshrc and persists through a Launch Agent that runs every ten minutes.

The resulting backdoor can execute commands, upload and download files, perform host reconnaissance, and spread across the network. For persistence it injects itself into popular corporate applications — DingTalk, Wukong and Qoder.

Who is behind the attack

Attribution has not been established, but Chinese-language comments in the source code and GitHub commits with a UTC+08:00 time zone point to a Chinese-speaking attacker targeting Chinese-speaking developers. The download counts for the packages are low, but because of the campaign's targeted nature and its ability to move laterally, the real damage is hard to gauge.

Anyone who installed any of the packages listed is advised to assume compromise: rotate sensitive credentials from a clean machine and inspect their workstations for signs of intrusion.

Source: The Hacker News