Cybersecurity researchers have discovered a new series of malicious npm packages targeting users of Alibaba development tools with a cross-platform remote RAT as part of a sophisticated, targeted attack on the software supply chain targeting Chinese-speaking environments.
See also: New Cross-Platform “Noodle RAT” Malware Targets Windows and Linux
One of the packages under consideration is “lib-mtop“, an unspecified package with the same name as a private Alibaba package under the “@ali“ scope. Although the npm package was first published in November 2023 without functionality, three new versions (v1.0.1, v1.0.2, and v1.0.3) were uploaded earlier in March and April.
It's unclear whether this was the result of a maintainer account takeover or if the project developer chose to act independently. Regardless, the new changes include a loader designed to retrieve a remote JavaScript payload using curl and then execute it.
The same maintainer account “ch4ce”, which is currently redirecting to a “not found” error on npmjs.com, has also published four other packages: aone-kit, aone-kit-cli, aone-sandbox and local-config-parser.
“ The first three are empty wrappers that have the same name as private, @ali-scoped packages that are declared as a dependency in the package.json file, ” Socket security researcher Karlo Zanki said in an analysis.
The last package, local-config-parser, implements a legitimate JSON configuration file parser but has dependencies that are, by themselves, innocent and published by other npm user accounts. When combined, they act as a conduit for an advanced RAT that targets developers likely working at companies that are part of the Alibaba Group.
Specifically, the malicious loader functionality is split and embedded in various packages that are delivered to targets as part of the same dependency tree. The top packages, which pretend to be private packages from the @ali domain, act as decoys that trigger the installation of the dependency tree.
See also: European Union: Opposes Cross-Platform for Apple's iMessage
“When such a package is installed in an environment that has access to mocked, specified private packages, dependency resolution works as expected, with a little extra functionality delivered through additional dependencies that are installed,” Socket explained.
Up to 10 top-level bait packages have been found to depend on “smart-config-manager,” which acts as a middle-layer bridge connecting them to the malicious packages containing the loader logic. One of the low-layer packages communicates with a GitHub repository to retrieve and store a rule engine configuration, which it then uses to execute a malicious payload that communicates with a remote server to retrieve secondary malware.
Importantly, the rule engine uses the vm module to implement the final phase and perform the payload download depending on the victim’s operating system. The payload is retrieved from a domain that impersonates Alibaba (“aone-cli-next.oss-cn-beijing.aliyuncs.com”) to integrate and evade detection.
On Windows, it terminates the Alilang security, VPN, and office productivity application and replaces its core code with a modified version. On Linux, it downloads a binary payload to /tmp , runs it as a disconnected process, and deletes the file from disk after it is loaded into memory. On macOS, it injects a malicious background script into ~/.zshrc and sets a 10-minute Launch Agent.
The final payload is a complex backdoor equipped with extensive command execution capabilities, arbitrary file upload and download, computer identification, payload preparation, and lateral movement capabilities. It also has the ability to remain active by injecting malicious code into common enterprise collaboration applications such as DingTalk, Wukong, and Qoder.
See also: Cross-Platform Malware: How Trojans Exploit Windows, Linux, and Mac Simultaneously
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Exactly who is behind the campaign is unknown, but the presence of Chinese language comments in the source code, combined with the fact that the commits on GitHub are timestamped, suggests a targeted effort.
