Key Takeaways
Socket researcher Karlo Zanki identified 18 npm packages impersonating official Alibaba-scoped tools, part of a layered decoy-and-payload supply chain campaign.
The malware installs a cross-platform RAT with command execution, file exfiltration, and lateral movement capabilities across Windows, Linux, and macOS.
On Windows it disables the Alilang security agent; on macOS it persists via a Launch Agent and a modified .zshrc file, both classic techniques for surviving reboots.
Researchers assess the campaign's goal as industrial espionage against Chinese-speaking developers using Alibaba Group tooling, not opportunistic financial crime.
Any organization that installed these packages should assume compromise and rotate credentials from a clean machine, not just remove the package.
A decoy layer built specifically to survive a quick look
On August 3, The Hacker News detailed a supply chain campaign, first flagged by Socket security researcher Karlo Zanki, involving 18 malicious npm packages: lib-mtop, aone-kit, aone-kit-cli, aone-sandbox, local-config-parser, smart-config-manager, cloud-config-fetcher, fast-transform-pipeline, aone-cloud-cli, colder-cli, def-open-client, feedback-ai-sdk, flight-compare-analyzer, lwp-web-client, lzd-unified-station-sdk, open-worker-cli, test-skill-zip, and uniapi-bridge. Each name is chosen to look like a legitimate Alibaba Group internal tool, the kind of package a developer at an Alibaba-adjacent company would install without a second thought. The naming convention alone tells you the attackers did their homework on the target ecosystem before writing a line of malicious code.
What makes this campaign notable is its structure, not just its scale. The packages are not uniformly malicious; instead they form layers. Decoy packages impersonate real Alibaba @ali-scoped libraries, a package called smart-config-manager sits in the middle as a bridge, and lower-layer packages fetch a rule engine configuration from a GitHub repository at install time. That configuration determines which payload actually executes, based on the victim's operating system, meaning the malicious behavior is decided after installation rather than baked into a single static package that scanners could fingerprint easily. That design choice is what let the campaign persist across 18 separate packages before a researcher connected the pieces.
What lands on the machine once you npm install
The final payload is a fully cross-platform remote access trojan with command execution, file upload and download, host reconnaissance, and lateral movement built in, along with persistence mechanisms tuned to each operating system. On Windows, it terminates the Alilang security software (Alibaba's endpoint protection agent) and replaces core system code. On Linux, it downloads a binary to /tmp and runs it as a detached background process. On macOS, it injects a malicious script into the user's .zshrc file and installs a Launch Agent, both standard techniques for surviving a reboot without user interaction. None of these persistence mechanisms are novel on their own, but combining all three into a single cross-platform payload shows the campaign was built for scale, not a single opportunistic target.
The RAT also injects itself into enterprise collaboration applications specifically named in the research: DingTalk, Wukong, and Qoder. That is a deliberate choice, not incidental malware behavior. Targeting the messaging and collaboration tools an organization actually uses for internal communication gives an attacker a foothold that looks like normal application activity and a plausible channel for further reconnaissance or lateral movement inside a corporate network, well past the point where a simple antivirus signature would catch it. Collaboration tools are also where a lot of sensitive internal decision-making happens, which makes them a high-value observation post for anyone running a long-term espionage operation.
Espionage, not ransomware, and that changes the response
Researchers assessed the campaign's goal as industrial espionage targeting Chinese-speaking developers who use Alibaba Group tools, based on the targeting and the lateral-spread capabilities built into the payload. That distinction matters for incident response. A ransomware payload announces itself; an espionage RAT is built to stay quiet, persist, and exfiltrate over time. If your organization installed one of these packages and the malware has been sitting on a developer's machine for even a few days, the assumption should not be "we caught it in time," it should be "what did it see."
For any enterprise with developers touching Alibaba Cloud tooling, e-commerce integrations, or supply chain software that interoperates with Alibaba Group systems, this campaign is a reminder that targeted supply chain attacks increasingly narrow their aim rather than going broad. A campaign built around 18 specifically-named decoy packages, rather than typosquatting a handful of extremely popular libraries, suggests the attackers already had a target developer population in mind and built the lure to match it. Generic supply chain defenses tuned for mass typosquatting will miss campaigns engineered this precisely.
The recurring npm problem enterprises still have not solved
This is at least the third notable npm supply chain campaign of 2026 that enterprise security teams have had to respond to, following incidents involving hijacked maintainer accounts on widely used packages earlier in the year. The pattern is consistent: attackers exploit the trust developers place in package names, scopes, and install-time scripts, and defenders are almost always reacting after a researcher, not an internal control, catches the campaign. Most organizations still do not have automated blocking of postinstall scripts or runtime monitoring of what a freshly installed dependency actually does on first execution.
The layered decoy structure in this campaign, where the malicious logic is fetched from GitHub at install time rather than shipped in the package itself, is also a direct response to static scanning. Security tools that inspect package contents before installation will not see the final payload, because it does not exist yet at scan time. That should push engineering and security leaders toward runtime and behavioral controls on the CI/CD pipeline and developer endpoints, not just pre-install package reputation checks, which this campaign was specifically built to evade.
What to do if this touches your environment
If any of the 18 named packages appear in your dependency trees, lockfiles, or CI/CD build logs, assume compromise rather than simply removing the package and moving on. Rotate all credentials that were accessible from the affected machine, including cloud API keys, source control tokens, and any secrets stored in environment variables or config files, and do the rotation from a separate, verified-clean device. Audit the affected system for the persistence artifacts described above: unexpected Launch Agents, modified shell profiles, disabled security agents, and unfamiliar background processes.
More broadly, this is a good trigger to check whether your organization enforces a package allowlist or requires review before new dependencies are added to production repositories, particularly for teams working with regional cloud providers or e-commerce platforms whose tooling ecosystems are less scrutinized by Western security vendors than the mainstream JavaScript package landscape. A 30-second glance at a plausible-sounding package name is not a control; it is exactly the gap this campaign was engineered to exploit.
