18 Malicious npm Packages Target Alibaba Tool Users With Cross-Platform RAT
Summary
Researchers describe malicious npm packages impersonating Alibaba private packages to deliver a cross-platform RAT to developers. The article also reports a poisoned mrmustard release capable of stealing developer and cloud credentials.
Key points
- Malicious npm packages impersonated private Alibaba packages and used a layered dependency tree to deliver a payload; the packages’ maintainer and the campaign operator are unknown.
- The RAT’s actions vary by OS: it replaces an Alilang application’s core code on Windows, runs a downloaded binary on Linux, and adds a background script and Launch Agent on macOS.
- The backdoor supports command execution, file transfers, host reconnaissance, payload staging, lateral movement, and persistence in collaboration applications.
- Researchers said the campaign may target Chinese-speaking developers and may support industrial espionage; the number of downloads was not significant, but its impact is unclear.
- Users who installed the listed packages are advised to assume compromise, rotate sensitive credentials from a clean machine, and audit developer systems.
- A separate poisoned mrmustard 0.7.4 release was reported to steal SSH keys, AWS credentials, and Kubernetes configurations; researchers said it also collected research and HPC environment data.
Article Details
- Attack Vectors
- Malicious npm packages impersonated Alibaba private packages and used layered dependencies to deliver a cross-platform RAT to developer environments.
- A loader fetched and executed remote JavaScript; a rule engine selected OS-specific payload behavior.
- On Windows, the payload terminated Alilang enterprise security, VPN, and office applications and replaced core code with a trojanized version.
- On Linux, it ran a downloaded binary as a detached process and deleted the file after loading it into memory.
- On macOS, it modified ~/.zshrc and set up a Launch Agent.
- A separate poisoned mrmustard 0.7.4 release ran an information stealer on package import, harvesting SSH keys, AWS credentials, and Kubernetes configurations and exfiltrating them to an attacker server.
- Defensive Notes
- Users who installed any of the listed malicious packages should assume compromise.
- Rotate sensitive credentials from a clean machine.
- Audit developer systems for signs of suspicious activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | aone-cli-next[.]oss-cn-beijing[.]aliyuncs[.]com | Payload-delivery domain masquerading as Alibaba infrastructure. |
| DOMAIN | metrics[.]femboy[.]energy | Attacker server identified as the destination for exfiltrated data from the poisoned mrmustard release. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe mrmustard stealer exfiltrated harvested credentials and configurations to an attacker server.T1059.007 · JavaScriptThe loader and rule engine used JavaScript, including the vm module, to execute the payload logic.T1070.004 · File DeletionOn Linux, the payload deleted its downloaded binary from disk after loading it into memory.T1082 · System Information DiscoveryThe final payload had host reconnaissance capabilities.T1105 · Ingress Tool TransferThe loader retrieved remote JavaScript and payloads, including a secondary malware payload.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious npm packages impersonated Alibaba private packages and delivered the RAT through a layered dependency tree.T1543.001 · Launch AgentOn macOS, the payload set up a Launch Agent with a 10-minute interval.T1546.004 · Unix Shell Configuration ModificationOn macOS, the payload inserted a malicious background script into ~/.zshrc.T1552.004 · Private KeysThe separate mrmustard stealer harvested SSH private keys.T1562.001 · Disable or Modify ToolsOn Windows, the payload terminated the Alilang enterprise security application.
People
Vendors
Products
AlilangOn Windows, it terminates the Alilang enterprise security, VPN, and office productivity app and replaces its core code with a trojanized version.AWSA separate poisoned mrmustard release stole SSH keys, AWS credentials, and Kubernetes configs.DingTalkIt also has the capacity to persist by injecting malicious code into common enterprise collaboration applications like DingTalk, Wukong, and Qoder.KubernetesA separate poisoned mrmustard release stole SSH keys, AWS credentials, and Kubernetes configs.mrmustardA separate poisoned mrmustard release stole SSH keys, AWS credentials, and Kubernetes configs.npmResearchers found malicious npm packages that impersonate Alibaba private packages and deliver a cross-platform RAT against Chinese-speaking developers in a targeted supply chain campaign.QoderIt also has the capacity to persist by injecting malicious code into common enterprise collaboration applications like DingTalk, Wukong, and Qoder.WukongIt also has the capacity to persist by injecting malicious code into common enterprise collaboration applications like DingTalk, Wukong, and Qoder.