Sophisticated npm Supply Chain Attack Delivers Cross-Platform RAT Targeting Developers

Cybersecurity researchers have uncovered a sophisticated software supply chain attack targeting the Node Package Manager (npm) ecosystem, where threat actors distributed a cross-platform Remote Access Trojan (RAT) through a carefully layered dependency chain.

The campaign remained active for more than three months without detection and appears to have specifically targeted developers working in environments associated with Alibaba Group.

By distributing malicious functionality across multiple seemingly legitimate npm packages and publisher accounts, the attackers successfully concealed the complete infection chain, making traditional security analysis significantly more difficult.

Sophisticated npm Supply Chain Attack

The investigation began with the discovery of an npm package named lib-mtop, which initially appeared to function as a simple downloader.

Although the package had existed on the npm registry for approximately three years, researchers observed suspicious activity after three new versions were published in late March 2026.

The sudden updates raised concerns that the maintainer’s account may have been compromised, although investigators noted that intentional malicious activity by the package maintainer could not be completely ruled out.

The package’s name also closely resembled internal Alibaba packages published under the private @ali namespace, increasing the likelihood that developers could mistake it for a legitimate internal dependency.

Researchers explained that the attack exploited trust in private package namespaces. Organizations using internal npm registries often rely on package names similar to public repositories, and developers whose environments can access both private and public registries may unknowingly install malicious dependencies when package resolution falls back to the public npm registry.

This technique enables attackers to weaponize familiar package names without directly compromising private repositories, making the attack particularly dangerous for enterprise development environments.

Although lib-mtop itself contained only a lightweight downloader that retrieved and executed remote JavaScript code, investigators soon discovered that it formed only one component of a much larger malware delivery framework.

The attackers intentionally divided the malicious workflow across multiple npm packages published by different accounts, ensuring that each package appeared benign when analyzed individually.

This modular architecture complicated automated malware detection because no single package contained the complete malicious payload or attack logic.The first layer of the campaign consisted of lure packages impersonating Alibaba-related developer tools.

Package names such as aone-cloud-cli, open-worker-cli, uniapi-bridge, and lzd-unified-station-sdk appeared to provide legitimate enterprise functionality while declaring dependencies on authentic-looking @ali packages alongside a malicious intermediary package named smart-config-manager.

This dependency-based delivery model allowed attackers to hide malicious behavior behind seemingly normal software installation processes.

Further investigation revealed that smart-config-manager relied on two additional packages named cloud-config-fetcher and local-config-parser. Individually, both packages performed the functions described in their documentation.

One downloaded configuration files from an attacker-controlled GitHub repository, while the other parsed configuration rules stored within those files. Because each component behaved as advertised, conventional static analysis and reputation-based detection mechanisms failed to classify them as malicious.

However, their automatic initialization routines silently linked together into a coordinated download-and-execute chain that ultimately delivered malware onto developer systems.

The downloaded configuration file contained malicious JavaScript hidden inside what appeared to be legitimate configuration rules.

Researchers found that the embedded code abused Node.js virtual machine functionality to escape its intended execution sandbox.

Once outside the restricted environment, the malware gained access to the host Node.js process and attempted several techniques to reach the application’s module-loading system, enabling execution of additional payloads with elevated capabilities.

Following successful code execution, the malware performed extensive system reconnaissance to identify the victim’s operating system before downloading a platform-specific version of the aone-cli Remote Access Trojan.

Separate payloads were available for Windows, macOS, and Linux, allowing the attackers to compromise developers regardless of their preferred development platform.

On macOS systems, the malware established persistence by modifying shell startup files and creating a Launch Agent. Windows variants reportedly attempted to disable the Alibaba-developed Alilang security application before replacing critical application files with trojanized versions.

On Linux systems, the malware executed a downloaded binary in the background before deleting the original file to reduce forensic evidence.

Researchers also identified several malicious packages associated with the campaign, including lib-mtop, aone-kit, aone-kit-cli, aone-sandbox, local-config-parser, smart-config-manager, cloud-config-fetcher, fast-transform-pipeline, and aone-cloud-cli.

Analysis of GitHub activity linked to the operation revealed repository commits timestamped using the UTC+08:00 (China Standard Time) timezone, with several commits occurring on the same day that the malicious npm packages were published.

While timezone information alone cannot determine attribution, it provides useful context for ongoing threat intelligence investigations.

Security experts recommend that organizations immediately audit software dependencies for the identified malicious packages, verify package authenticity before installation, enforce strict dependency management policies, and implement continuous software supply chain monitoring.

Developers should prioritize private package registries over public repositories whenever possible, enable package integrity verification, and monitor build environments for unexpected outbound network activity.

As software supply chain attacks continue to evolve in sophistication, this campaign demonstrates how attackers increasingly leverage trusted development ecosystems to infiltrate enterprise environments while remaining hidden behind legitimate dependency relationships.