11 minhigh
Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers
Attackers distributed malicious functionality across a cluster of npm packages that impersonate private Alibaba (@ali scope) packages, triggering a multi-stage download chain that ultimately deploys a cross-platform RAT named aone-cli. The malware employs a Node.js vm sandbox-escape technique to gain process-level access, uses Alibaba Cloud OSS and a compromised GitHub repository to blend malicious traffic with legitimate infrastructure, and establishes persistence via shell profile modification, Launch Agents, code injection into AI tooling, and replacement of a legitimate security application's core code on Windows.
Sens:■ Immediate
Showing defanged values
- domaindiamond-cli-znsxphqell[.]cn-shanghai[.]fcapp[.]runReverse-proxy WebSocket C2 endpoint used by the RAT
- domainxemzqli2vu[.]ai-app[.]pubPrimary command-and-control domain used by the aone-cli RAT for check-in and command polling
- npm_packagelocal-config-parserLow-layer npm package containing the vm-sandbox-escape rule evaluation logic used to execute the malicious downloader
- npm_packagesmart-config-managerMiddle-layer npm package that pulls in cloud-config-fetcher and local-config-parser to assemble loader functionality
- sha2560910ecfa049738ef3f2540855341a380df89224ff71da94b4c21689fd66f62e3aone-cli.js payload deployed on macOS systems
- sha25633b58598eb317553942e27545982d4c25ce6120eae10e42393746eb0e02ecae9aone-kit-update payload deployed on Linux systems from the lib-mtop package
- sha25641957bd0ba2d9c07af2e069f10780fdf6b2102c065bebe0db2136dfe07d67a28crypto.js third-stage loader delivered via the lib-mtop package
- sha2566044974c633b3a319c31bb32110411520c425e89722a64806528553227e7a50asetting.js third-stage loader payload
- sha25684a6ccaaab1596139d28e822f40cc99c68d337d4c81d1c6d9692c1d6bb22e4afpreferences.json config file containing malicious rules with second-stage loader
- sha256b8b81af76163bdcc5b4f7d8fe6795f164991f8a62678c971db031b9e90a27813aone-cli payload deployed on Linux systems
- sha256e5d8350f1540fe91145dc262c455bca7748ad97dafb2d9facd5adebed9f66d2daone-cli-deps.tar.gz containing older version of aone-cli.js
- sha256ef9a1896eeaae929800eade768276e2240ef252d26d0d96c1950a1a5e1aadb34aone-cli.zip payload deployed on Windows systems
- urlhxxps://aone-ai-cli[.]oss-cn-beijing[.]aliyuncs[.]com/app/release/aone-cliFourth-stage aone-cli RAT binary payload for Linux
- urlhxxps://aone-ai-cli[.]oss-cn-beijing[.]aliyuncs[.]com/app/release/aone-cli-deps[.]tar[.]gzPayload archive containing older version of aone-cli.js
- urlhxxps://aone-ai-cli[.]oss-cn-beijing[.]aliyuncs[.]com/app/release/aone-cli[.]jsFourth-stage aone-cli RAT payload for macOS
- urlhxxps://aone-ai-cli[.]oss-cn-beijing[.]aliyuncs[.]com/app/release/aone-cli[.]zipFourth-stage aone-cli RAT payload archive for Windows
- urlhxxps://aone-cli-next[.]oss-cn-beijing[.]aliyuncs[.]com/config/setting[.]jsThird-stage loader payload hosted on Alibaba Cloud OSS to blend with legitimate traffic
- urlhxxps://aone-kit[.]oss-cn-beijing[.]aliyuncs[.]com/aone-kit-update/aone-kit[.]jsPayload delivery URL associated with lib-mtop campaign chain
- urlhxxps://aone-kit[.]oss-cn-beijing[.]aliyuncs[.]com/aone-kit-update/aone-kit-updateLinux payload delivered via lib-mtop package chain
- urlhxxps://aone-kit[.]oss-cn-beijing[.]aliyuncs[.]com/aone-kit-update/app[.]asarTrojanized Electron app.asar replacement used to compromise a legitimate security application on Windows
- urlhxxps://aone-kit[.]oss-cn-beijing[.]aliyuncs[.]com/plugins/crypto[.]jsThird-stage loader delivered via the lib-mtop package
- urlhxxps://raw[.]githubusercontent[.]com/smi1e2u/smart-config-manager/main/defaults/preferences[.]jsonAttacker-controlled GitHub-hosted configuration file containing the disguised second-stage loader logic
Detection / HunterAnthropic
What Happened
Security researchers found a group of fake software packages on the npm package registry (a public library used by software developers) that were designed to trick developers working with Alibaba's internal tools into installing them. Once installed, the fake packages quietly downloaded additional malicious code in stages, eventually installing a powerful remote-control program that lets attackers view files, run commands, take screenshots, and spread further inside a company's network using a popular Chinese workplace chat app called DingTalk. This mainly affects software developers at companies connected to Alibaba, but it matters because attackers could steal sensitive company data or secrets and move deeper into internal systems undetected for months. Anyone who may have installed the affected packages should treat their computer as compromised, remove the packages, and change any passwords or access keys that were on that machine, ideally from a different, clean computer.
Key Takeaways
- A coordinated cluster of 18+ npm packages, split across multiple maintainer accounts, delivers a multi-stage downloader chain culminating in a cross-platform RAT targeting Alibaba-affiliated developers.
- Top-layer lure packages impersonate private, unscoped @ali-scope Alibaba packages to trigger installation only in environments with access to those private packages, indicating deliberate targeting.
- The malware uses a Node.js vm module sandbox-escape technique (via items.constructor.constructor) to break out of an isolated rule-evaluation engine and reach the global process object.
- The final aone-cli payload is a full-featured RAT with file exfiltration, arbitrary command execution, reverse proxy, AI-tool code injection persistence, and DingTalk-based lateral movement.
- Campaign infrastructure (GitHub repo and Alibaba Cloud OSS buckets used for payload hosting) has remained active for over 3 months, suggesting a well-resourced, patient, likely Chinese-speaking threat actor pursuing industrial espionage.
Affected Systems
- Node.js/npm developer environments with access to private @ali-scoped packages
- macOS developer workstations
- Windows developer workstations (Alilang security app targeted)
- Linux developer workstations
- DingTalk, Wukong, and Qoder enterprise collaboration tool installations
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Developers install unscoped top-layer npm packages that impersonate private @ali-scoped Alibaba packages
- Delivery: Dependency resolution pulls in the middle-layer smart-config-manager package, which depends on cloud-config-fetcher and local-config-parser
- Second Stage: cloud-config-fetcher downloads a disguised rules configuration from an attacker-controlled GitHub repository and saves it locally
- Defense Evasion: local-config-parser evaluates the rules using Node.js vm module, and the hidden malicious rule uses a sandbox-escape technique to access the global process object
- C2/Payload Retrieval: Escaped code accesses Node's module loader, downloads a third-stage setting.js loader from an Alibaba Cloud OSS bucket, performs platform fingerprinting, and downloads platform-specific aone-cli payload
- Persistence & Lateral Movement: aone-cli establishes OS-specific persistence (Launch Agent on macOS, trojanized security app on Windows, memory-resident binary on Linux), injects code into AI-tool Python scripts, checks in to hardcoded C2, and enables lateral movement via DingTalk
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide any YARA, Sigma, Snort/Suricata, KQL, SPL, or EQL detection rules. It instead provides a full list of malicious package names, file hashes, C2 domains, delivery URLs, and specific string/environment-variable indicators to hunt for manually.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR could observe Node.js process spawning network connections, unusual child process creation (e.g., detached binaries on Linux, Launch Agent creation on macOS), and file writes to shell profiles or app.asar, but the initial malicious logic executes entirely within legitimate Node.js/npm processes, reducing signature-based detection likelihood. |
| Network Visibility | Medium | C2 traffic is deliberately blended with legitimate Alibaba Cloud OSS and GitHub raw content hosting, and spoofed Origin/Referer headers mimic DingTalk traffic, making network-based detection reliant on knowledge of specific domains/URLs rather than generic anomaly detection. |
| Detection Difficulty | Hard | The multi-package split of functionality, use of a vm sandbox-escape technique inside an apparently benign rule-evaluation package, and hosting of payloads on legitimate Alibaba Cloud infrastructure make static and behavioral detection difficult without specific IOC knowledge. |
Required Log Sources
- npm/package manager install logs
- Process creation logs (e.g., Sysmon Event ID 1)
- Network connection logs (Sysmon Event ID 3 / proxy logs)
- File creation/modification logs for shell profiles, Launch Agents, and app.asar
- DNS query logs
- HTTP proxy logs with header inspection capability
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Developer or CI/CD systems that installed recently-published npm packages exhibit unexpected outbound HTTP requests to GitHub raw content or cloud storage domains shortly after npm install operations | Process-to-network correlation logs, npm install audit logs, DNS/proxy logs | Command and Control / Ingress Tool Transfer (T1105, T1071.001) | Medium — many legitimate packages fetch remote config or update data during install |
| Node.js processes are observed accessing process.mainModule, process.getBuiltinModule, or performing unusual constructor-chain traversal indicative of vm sandbox escape | Application-level JS runtime tracing or EDR script-block logging if available | Defense Evasion (T1140/T1027) | Low — this pattern is uncommon in legitimate configuration-rule evaluation code |
| HTTP requests to internal or external services contain Origin/Referer headers set to a DingTalk domain but originate from a process other than a browser or DingTalk client | Proxy/network logs with HTTP header inspection | Command and Control (T1071.001) | Low — spoofed headers from non-browser processes are unusual |
| Python files within AI-tool .skills directories contain an unexpected injected marker comment or subprocess.Popen call not part of the original tool codebase | File integrity monitoring, endpoint file scanning | Persistence (T1546.004 equivalent for AI tool injection) | Low — the marker string is a specific attacker-defined value |
| Environment variables named ROBOT_UID with a specific hardcoded value are present on developer or CI machines | Endpoint environment variable auditing, process environment capture | Discovery / Command and Control indicator | Low — this is a very specific and non-generic variable name/value pairing |
Control Gaps
- Standard package registry vetting (download counts, publish age) does not catch coordinated multi-account, multi-package campaigns that split malicious logic across dependencies
- Static analysis of individual packages in isolation misses malicious behavior since no single package appears malicious on its own
- Traditional domain/IP blocklists are ineffective when payloads are hosted on legitimate, high-reputation cloud storage (Alibaba Cloud OSS) and code hosting (GitHub) platforms
- Sandboxed script execution (Node.js vm module) is not a reliable security boundary against determined attackers using known escape techniques
Key Behavioral Indicators
- npm package installation triggering outbound network connections to GitHub raw content or cloud storage shortly after install
- Unscoped package names that closely mimic known private/scoped package names
- Multiple newly-created npm publisher accounts publishing interdependent packages within a short time window
- Modification of shell profile files (e.g., .zshrc) by a Node.js process
- Unexpected replacement of application core files (e.g., app.asar) by non-installer processes
- Detached background processes spawned from Node.js on Linux that subsequently delete their own binary from disk
False Positive Assessment
Low — the specific indicators provided (exact package names, hashes, C2 domains, injection marker string, and ROBOT_UID value) are highly specific to this campaign and unlikely to appear in legitimate environments, though generic behavioral hunts (e.g., npm install triggering network activity) carry medium false-positive risk.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting; treat any machine that installed the listed npm packages as potentially compromised and isolate it from the network where feasible.
- Identify all developer and CI/CD machines that installed any of the listed malicious packages using package manager logs or lockfile scanning.
- Remove the affected packages and audit package.json/lockfiles across all repositories for references to them.
- Preserve forensic artifacts (memory, disk images, logs) from affected machines before performing cleanup, where feasible.
- Rotate npm, GitHub, PyPI, RubyGems, cloud provider, Vault, Kubernetes, Docker, SSH, Slack, Twilio, and CI/CD secrets that were accessible from affected environments, performing rotation from a known-clean machine.
Infrastructure Hardening
- Consider implementing internal npm package allowlisting or private registry proxying to prevent installation of unscoped packages that mimic reserved/private scope names.
- Evaluate egress filtering or proxy rules to flag or block outbound connections from developer/build environments to unexpected GitHub raw content or cloud storage endpoints during package installation.
- Consider monitoring for and alerting on HTTP requests carrying spoofed Origin/Referer headers inconsistent with the originating process.
- Evaluate integrity monitoring for critical application binaries (e.g., app.asar of security tooling) to detect unauthorized replacement.
User Protection
- Consider deploying endpoint monitoring for file modifications to shell profile files (.zshrc, .bashrc) and unexpected Launch Agent/scheduled task creation.
- If your EDR supports script-block or JS runtime logging, consider enabling it for Node.js processes on developer workstations to detect vm sandbox-escape patterns.
- Audit developer machines for the presence of the '# INJECT_MARKER' string in Python files under AI-tool .skills directories.
- Check for the ROBOT_UID environment variable with the reported value as a compromise indicator across developer and CI systems.
Security Awareness
- Consider briefing developers on the risks of typosquatting and scope-impersonation in package registries, especially packages referencing reserved/private organizational scopes.
- Encourage developers to verify package publisher history, account age, and recent version-publishing patterns before installing dependencies, particularly for internal-tooling-named packages.
- Incorporate this campaign as a case study in supply-chain security awareness training, emphasizing that individually benign-looking packages can combine to form malicious functionality.
- Remind teams to report unexpected npm install behavior (e.g., unexplained network activity) promptly rather than dismissing it.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping16 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Stealth
Tactic
Lateral Movement
Tactic
Collection
Tactic
Command and Control
Tactic
Exfiltration
Additional IOCs
- Urls:
hxxps://aone-ai-cli[.]oss-cn-beijing[.]aliyuncs[.]com/app/release/aone-cli-deps.tar.gz- Payload archive containing older version of aone-cli.jshxxps://aone-kit[.]oss-cn-beijing[.]aliyuncs[.]com/plugins/crypto.js- Third-stage loader delivered via the lib-mtop packagehxxps://aone-kit[.]oss-cn-beijing[.]aliyuncs[.]com/aone-kit-update/aone-kit.js- Payload delivery URL associated with lib-mtop campaign chainhxxps://aone-kit[.]oss-cn-beijing[.]aliyuncs[.]com/aone-kit-update/app.asar- Trojanized Electron app.asar replacement used to compromise a legitimate security application on Windowshxxps://aone-kit[.]oss-cn-beijing[.]aliyuncs[.]com/aone-kit-update/aone-kit-update- Linux payload delivered via lib-mtop package chain
- File Hashes:
84a6ccaaab1596139d28e822f40cc99c68d337d4c81d1c6d9692c1d6bb22e4af(SHA256) - preferences.json config file containing malicious rules with second-stage loader0910ecfa049738ef3f2540855341a380df89224ff71da94b4c21689fd66f62e3(SHA256) - aone-cli.js payload deployed on macOS systemsb8b81af76163bdcc5b4f7d8fe6795f164991f8a62678c971db031b9e90a27813(SHA256) - aone-cli payload deployed on Linux systemsef9a1896eeaae929800eade768276e2240ef252d26d0d96c1950a1a5e1aadb34(SHA256) - aone-cli.zip payload deployed on Windows systemse5d8350f1540fe91145dc262c455bca7748ad97dafb2d9facd5adebed9f66d2d(SHA256) - aone-cli-deps.tar.gz containing older version of aone-cli.js41957bd0ba2d9c07af2e069f10780fdf6b2102c065bebe0db2136dfe07d67a28(SHA256) - crypto.js third-stage loader delivered via the lib-mtop package33b58598eb317553942e27545982d4c25ce6120eae10e42393746eb0e02ecae9(SHA256) - aone-kit-update payload deployed on Linux systems from the lib-mtop package
- File Paths:
.cloud-preferences.json- Local file where the fetched malicious configuration/rules are saved by cloud-config-fetcher~/.zshrc- macOS shell profile modified to insert a malicious background script for persistenceapp.asar- Core code file of the legitimate Alilang security app replaced with a Trojan copy on Windows/tmp- Linux directory used to stage the downloaded binary payload before detached execution and self-deletion~/.real/.bin/bun- Path referenced by injected Python code to locate the bun binary used to launch the malicious script.js
- Command Lines:
- Purpose: Download and execute a remote JavaScript payload from disk via require() | Tools:
curl,Node.js require()| Stage: Initial loader execution
- Purpose: Download and execute a remote JavaScript payload from disk via require() | Tools:
- Other:
3201d407b7899a12d6d439950511c6a5- Value assigned to the ROBOT_UID environment variable, used as an indicator that a machine has been compromised by the RAT# __INJECT_MARKER__- Marker comment inserted into Python scripts in AI-tool .skills directories to detect prior code injection by the malware
