VTA-000194 – Alibaba Developers Targeted By Malicious Npm Packages

A sophisticated software supply chain attack has been uncovered, targeting users of Alibaba developer tools with a cross-platform remote access trojan. The attack involves 18 malicious npm packages, including lib-mtop, aone-kit, and local-config-parser, which are designed to impersonate private packages from the @ali scope. These packages have been found to contain a loader that fetches a remote JavaScript payload using curl and executes it, allowing the attackers to gain control over the infected systems.

The malicious packages are delivered to the targets as part of the same dependency tree, with the top-layer packages serving as decoys that activate the installation of the dependency tree. The dependency resolution works as expected, with a little extra functionality delivered through additional dependencies that get installed. The attackers have used a rule engine to implement the final phase of the attack, which executes a malicious payload that contacts a remote server to fetch secondary malware. The payload is retrieved from a domain that masquerades as Alibaba to blend in and sidestep detection.

The impact of the campaign is hard to evaluate due to its targeted nature and lateral-spread capabilities. However, it is believed that the goal of the campaign is industrial espionage, and the attackers may be targeting Chinese-speaking developers who are likely working in companies that are part of the Alibaba Group. Users who have installed any of the malicious packages should assume compromise, rotate sensitive credentials from a clean machine, and audit developer systems for signs of suspicious activity. The disclosure of this attack highlights the importance of verifying the authenticity of packages and dependencies, especially in software development environments.

Severity:

Medium

Attack Surface:

Endpoint, Supply Chain (Third-party vendors)

Tactics:

Initial Access, Execution, Persistence, Lateral Movement

Techniques:

T1190 – Exploit Public-Facing Application

T1204 – User Execution

References:

1. https://npmjs.com

2. https://developer.aliyun.com

3. https://thehackernews.com/2026/08/18-malicious-npm-packages-deliver-cross.html

SuperPRO’s Threat Countermeasures Procedures:

1. Verify the authenticity of packages and dependencies before installation

2. Use a package manager that supports secure package verification, such as npm with the –audit flag

3. Rotate sensitive credentials from a clean machine after a potential compromise

4. Audit developer systems for signs of suspicious activity, such as unexpected network connections or file modifications

5. Implement a secure coding practice, such as code reviews and testing, to detect and prevent malicious code

6. Use a web application firewall (WAF) to detect and prevent malicious traffic

7. Keep systems and software up to date with the latest security patches

Contributed by: Anas Danial