Distributed npm Dependency Chain Assembles Cross-Platform RAT During Installation

Security researchers have uncovered a targeted npm supply-chain campaign that used a distributed dependency chain to install a cross-platform remote access trojan (RAT) on developer systems.

The operation reportedly remained active and undetected for more than three months and appears designed to target developers connected to Alibaba Group environments.

The investigation began with lib-mtop, an npm package that contained a basic downloader. The package was first published around three years ago but received three new versions in late March 202620262026.

This activity may indicate a maintainer account compromise, although a malicious maintainer cannot be ruled out.

The package was significant because its unscoped name resembled a private package under Alibaba’s @ali npm scope. The @ali scope is used for Alibaba internal tooling and packages.

Developers whose environments could access legitimate private dependencies could unknowingly receive extra malicious dependencies from the public npm registry.

Researchers found that lib-mtop downloaded a remote JavaScript payload and executed it locally. While the loader itself was simple, further analysis linked it to a wider network of packages that looked harmless when examined individually.

Cross-Platform RAT npm Supply Chain

The threat actors divided the malware delivery process across multiple npm packages and separate publisher accounts. This approach made the packages appear unrelated and helped obscure the full attack path.

At the top layer, lure packages impersonated internal Alibaba-style names, including aone-cloud-cli, open-worker-cli, uniapi-bridge, and lzd-unified-station-sdk.

These packages had little or no direct functionality. Instead, they declared dependencies on legitimate-looking @ali packages and a malicious middle-layer package named smart-config-manager.

Smart-config-manager depended on two lower-layer packages: cloud-config-fetcher and local-config-parser.

The first retrieved a configuration file from an attacker-controlled GitHub repository, while the second read and evaluated rules from that downloaded file.

Both components performed the tasks described in their package documentation, making them difficult to classify as malicious in isolation.

However, their automatic initialization behavior connected the components into a download-and-execute chain.

The downloaded configuration file contained code hidden inside what appeared to be a normal rule for processing values. The code abused Node.js virtual machine functionality to escape the intended sandbox.

It obtained access to the host Node.js process and attempted several methods to reach the module-loading system.

The later-stage payload performed system reconnaissance, detected the operating system, and downloaded a platform-specific aone-cli RAT. The final malware supported macOS, Windows, and Linux.

On macOS, it modified shell startup files and created a Launch Agent for persistence.

On Windows, it reportedly attempted to turn off the Alilang security application and replace core application files with a trojanized copy. On Linux, it ran a downloaded binary in the background and removed the file after loading.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.