18 Malicious npm Packages Deliver Cross-Platform RAT Targeting Alibaba Developer Tool Users — Threadlinqs Intelligence
As of 2026-08-03, 18 Malicious npm Packages Deliver Cross-Platform RAT Targeting Alibaba Developer Tool Users is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-1849 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Socket researchers discovered 18 malicious npm packages published across five accounts (including compromised account 'ch4ce') that deliver a sophisticated cross-platform remote access trojan (RAT)
In late March 2026, the npm package lib-mtop — which had been dormant for approximately three years — received three new versions (1.0.1, 1.0.2, 1.0.3) that added malicious downloader code. This marked the beginning of a large-scale, highly targeted software supply chain campaign aimed at developers working within the Alibaba Group ecosystem. Over the following month, attackers published a total of 18 malicious npm packages across five distinct publisher accounts (ch4ce, neural_dev, tensor_lab, luck_show, aone_code) to distribute the malicious functionality across separate packages, evading detection by appearing benign in isolation.
The campaign employs a sophisticated multi-layer dependency architecture. Ten top-layer lure packages (including aone-cloud-cli, colder-cli, def-open-client, and others) impersonate private @ali-scoped Alibaba internal packages using unscoped names. These lure packages all declare smart-config-manager as a dependency. Smart-config-manager in turn depends on two lower-layer packages: cloud-config-fetcher, which retrieves a configuration file from an attacker-controlled GitHub repository (smi1e2u/smart-config-manager) saved locally as .cloud-preferences.json, and local-config-parser, a JSON configuration file parser with a built-in rule evaluation engine that uses Node.js's vm module.
The local-config-parser package is the critical execution gateway. The malicious preferences.json rule file contains a classic Node.js vm sandbox escape: it recovers the host Function constructor via items.constructor.constructor, then calls F('return process')() to access the real Node.js process object. It then attempts six different methods to recover Node's module loader (process.getBuiltinModule, process.mainModule.require, process.mainModule.constructor._load, and three additional fallbacks searching the global scope), dynamically resolves the https module, and fetches a third-stage loader from an Alibaba Cloud OSS bucket designed to blend with legitimate traffic.
The third-stage loader (setting.js) fingerprints the host operating system and delivers a platform-specific RAT payload. On Windows, it terminates the Alilang enterprise security app and replaces its core app.asar file with a trojanized version. On Linux, it downloads a binary payload to /tmp, runs it as a detached process, and deletes the file from disk after it is loaded into memory for fileless execution. On macOS, it inserts a malicious background script into ~/.zshrc and installs a 10-minute Launch Agent for persistence.
The final payload is a full-featured cross-platform RAT (aone-cli) with an extensive command set: info, sleep, pwd, whoami, ipconfig/ifconfig, dir/ls, cat, read, screenshot, download, upload, pull, execute, run_python, proxy, aisearch, install_python_module, install_node_module, aipoison, aipoison_inject, aipoison_deploy, dws_lateral, and exit. Commands not in the predefined list are forwarded to the local operating system shell. The RAT establishes C2 via the domain xemzqli2vu.ai-app.pub and a reverse-proxy WebSocket endpoint at diamond-cli-znsxphqell.cn-shanghai.fcapp.run (Alibaba Cloud Function Compute). All HTTP traffic includes forged Origin: https://alidocs.dingtalk.com and Referer: https://alidocs.dingtalk.com headers to masquerade as legitimate DingTalk API traffic.
A distinctive feature of this RAT is its AI-tool poisoning capability. The aipoison family of commands targets Python scripts inside .skills directories of the enterprise collaboration tools DingTalk, Wukong, and Qoder. It injects code marked with the comment # __INJECT_MARKER__ that uses the Bun runtime (~/.real/.bin/bun or bun.exe on Windows) to execute a script.js payload from ~/.real/.bin/, relaunching persistently through the developer's AI tooling environment. The RAT also includes a dedicated DingTalk lateral movement command (dws_lateral) for propagating across compromised organizations, and uses environment variable ROBOT_UID=3201d407b7899a12d6d439
Weaknesses (CWE)
CWE-506, CWE-94, CWE-829
Target sectors: technology, software-development, cloud-computing
Target regions: china, Global
Detections & IOCs
As of 2026-08-10, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1195, T1059, T1204, T1546, T1053, T1554, T1055, T1036, T1027, T1552
