Cybersecurity researchers have discovered a new set of malicious npm packages that target users of Alibaba developer tools with a cross-platform remote access trojan (RAT) as part of a sophisticated, targeted software supply chain attack targeting Chinese-speaking environments.
One of the packages in question is “lib-mtop,” an unscoped package with the same name as a private Alibaba package under the “@ali” scope. Although the npm package was first published sometime in November 2023 with no functionality, three new versions (v1.0.1, v1.0.2, and v1.0.3) were uploaded earlier this March and April.
It’s currently not clear if this was the result of a maintainer account takeover or the project developer opting to go rogue. Regardless of how the malicious changes were pushed, the newly added changes feature a loader that’s designed to fetch a remote JavaScript payload using curl and then execute it.
The same maintainer account “ch4ce,” which currently redirects to a “not found” error on npmjs[.]com, has also published four other packages: aone-kit, aone-kit-cli, aone-sandbox, and local-config-parser.
“The first three are empty wrappers that have the same name as private, @ali-scoped packages which they declare as a dependency in the package.json file,” Socket security researcher Karlo Zanki said in an analysis.
The last package, local-config-parser, implements a legitimate JSON configuration file parser, but features dependencies that, on their own, are innocuous and are published from other npm user accounts. When combined together, they serve as a conduit for an advanced RAT targeting developers who are likely working in companies that are part of the Alibaba Group.
Specifically, the malicious loader functionality is split and embedded into several packages delivered to the targets as part of the same dependency tree. The top-layer packages, which impersonate private packages from the @ali scope, serve as decoys that activate the installation of the dependency tree.
“When such a package is installed in an environment that has access to impersonated, scoped private packages, the dependency resolution works as expected, with a little extra functionality delivered through additional dependencies that get installed,” Socket explained.
As many as 10 top-layer lure packages have been found to depend on “smart-config-manager,” which functions akin to a middle-layer bridge that connects them to the malicious packages containing the loader logic. One of the low-layer packages proceeds to contact a GitHub repository to retrieve and store a rule engine configuration, and then it uses it to execute a malicious payload that then contacts a remote server to fetch secondary malware.
What’s notable about the attack is that the rule engine makes use of the vm module to implement the final phase and perform the payload download depending on the victim’s operating system. The payload is retrieved from a domain that masquerades as Alibaba (“aone-cli-next.oss-cn-beijing.aliyuncs[.]com”) to blend in and sidestep detection.
This stage performs a number of actions –
- On Windows, it terminates the Alilang enterprise security, VPN, and office productivity app and replaces its core code with a trojanized version.
- On Linux, it downloads a binary payload to /tmp, runs it as a detached process, and deletes the file from disk after it’s loaded into memory.
- On macOS, it inserts a malicious background script into ~/.zshrc and sets up a 10-minute Launch Agent.
The final payload is a complex backdoor equipped with comprehensive command execution, arbitrary file upload and download, host reconnaissance, payload staging, and lateral movement capabilities. It also has the capacity to persist by injecting malicious code into common enterprise collaboration applications like DingTalk, Wukong, and Qoder.
Exactly who is behind the campaign is unknown, but the presence of Chinese language comments in the source code, combined with the fact that GitHub commits are timestamped with the UTC+08:00 offset, indicates that it’s possibly the work of a Chinese-speaking threat actor going after Chinese-speaking developers using tools belonging to Alibaba Group.
“The goal of the campaign seems to be industrial espionage,” Zanki noted. “While the number of downloads for the malicious packages is not significant, the impact of the campaign is hard to evaluate, because of the targeted nature and lateral-spread capabilities of the final-stage payload.”
The complete set of packages associated with the campaign is below –
- lib-mtop
- aone-kit
- aone-kit-cli
- aone-sandbox
- local-config-parser
- smart-config-manager
- cloud-config-fetcher
- fast-transform-pipeline
- aone-cloud-cli
- colder-cli
- def-open-client
- feedback-ai-sdk
- flight-compare-analyzer
- lwp-web-client
- lzd-unified-station-sdk
- open-worker-cli
- test-skill-zip
- uniapi-bridge
Users who have installed any of the above packages should assume compromise, rotate sensitive credentials from a clean machine, and audit developer systems for signs of suspicious activity.
The disclosure comes as unknown threat actors published a poisoned version of mrmustard (0.7.4), the photonic quantum computing Python library from Xanadu, to run an information stealer capable of harvesting SSH private keys, AWS credentials, and Kubernetes configurations, and exfiltrating them to an attacker server (“metrics.femboy[.]energy”).
According to StepSecurity, the payload runs on every package import. Further analysis indicates that the primary maintainer’s GitHub account was breached to push the rogue version by probing the project’s self-hosted CI runners and exfiltrating its publishing secrets to a webhook[.]site URL.
The malware “had three separate persistence mechanisms installed that keep a stealer running long after the package is uninstalled,” SafeDep said. “The credential theft targets research and HPC environments, collecting SLURM job queues and GPU inventories alongside the usual cloud secrets.”
