Socket: Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers

What it is

A targeted npm supply-chain campaign against developers inside Alibaba Group, uncovered by Socket (Karlo Zanki). The entry point was lib-mtop, a three-year-old package whose original single version had no functionality — three new versions appeared end of March 2026, suggesting maintainer account takeover. The campaign delivers a cross-platform RAT (data exfiltration, command execution, DingTalk-based lateral movement) and stayed undetected for ~3 months.

How it works

The core trick is name-squatting the reserved @ali private scope with unscoped lookalike names. When installed in an environment with access to the real private @ali packages, dependency resolution succeeds and pulls the extra malicious dependencies alongside. Functionality is deliberately split so each package passes review in isolation:

• cloud-config-fetcher — auto-init downloads a config to a local file .cloud-preferences.json.
• local-config-parser — auto-init reads that same file and evaluates its rules via Node's vm module.
• smart-config-manager — middle layer depending on both above; all 10 top-layer lures depend on it.

Split across accounts, the two low-layer packages each independently look like legitimate rule-evaluation utilities; combined they form download-and-execute.

Preconditions / Affected

Matters only to developers/CI with access to the genuine private @ali scope — otherwise resolution of the impersonated scoped dependency fails. Node.js projects installing the unscoped lure packages.

What to do

Audit for and remove these packages, and check installs against publisher/date signals (campaign staged April 27–28; most accounts newly created).

Lure/component packages:

lib-mtop, aone-kit, aone-kit-cli, aone-sandbox
smart-config-manager, cloud-config-fetcher, local-config-parser
node-data-utils, fast-transform-pipeline
aone-cloud-cli, colder-cli, def-open-client, feedback-ai-sdk,
flight-compare-analyzer, lwp-web-client, lzd-unified-station-sdk,
open-worker-cli, test-skill-zip, uniapi-bridge

Publisher accounts: neural_dev, tensor_lab, ch4ce, luck_show, aone_code.

Hunt for the dropped file and the payload URL:

.cloud-preferences.json
hxxps://raw[.]githubusercontent[.]com/smi1e2u/smart-config-manager/main/defaults/preferences.json

flowchart TD
    L[Unscoped lure e.g. lib-mtop] --> R{Env has real @ali scope?}
    R -->|no| F[Resolution fails - inert]
    R -->|yes| S[smart-config-manager]
    S --> C[cloud-config-fetcher]
    S --> P[local-config-parser]
    C -->|downloads| J[.cloud-preferences.json from GitHub]
    J --> P
    P -->|vm eval of rules| RAT[Cross-platform RAT]

Caveats

Socket states the takeovers are inferred (lib-mtop version pattern; ch4ce being an older account) — "a maintainer going rogue can't be excluded." The fetched text cuts off before detailing the RAT payload itself, so the specifics of exfiltration and DingTalk lateral movement beyond the capability list are not reproduced here.