Cybersecurity researchers have discovered a new set of malicious npm packages that target users of Alibaba developer tools with a cross-platform remote access trojan (RAT) as part of a sophisticated, targeted software supply chain attack targeting Chinese-speaking environments.
One of the packages in question is "lib-mtop," an unscoped package with the same name as a private Alibaba package under the "@ali" scope. Although the npm package was first published sometime in November 2023 with no functionality, three new versions (v1.0.1, v1.0.2, and v1.0.3) were uploaded earlier this March and April.
It's currently not clear if this was the result of a maintainer account takeover or the project developer opting to go rogue. Regardless of how the malicious changes were pushed, the newly added changes feature a loader that's designed to fetch a remote JavaScript payload using curl and then execute it.
The same maintainer account "ch4ce," which currently redirects to a "not found" error on npmjs[.]com, has also published four other packages: aone-kit, aone-kit-cli, aone-sandbox, and local-config-parser.
"The first three are empty wrappers that have the same name as private, @ali-scoped packages which they declare as a dependency in the package.json file," Socket security researcher Karlo Zanki said in an analysis.
