Malicious npm Packages Targeting Alibaba Developer Tools with Cross-Platform RAT

Technical Analysis

The attack uses namespace/name collision tactics, publishing an unscoped public package ('lib-mtop') that mirrors the name of a private internal Alibaba package, exploiting dependency resolution logic to trick build systems or developers into installing the malicious version instead of the legitimate internal one. Once installed, the package deploys a cross-platform RAT capable of running on multiple operating systems, granting attackers persistent remote access to developer machines and CI/CD environments. This is consistent with broader npm supply chain attack patterns where malicious install scripts or post-install hooks execute payloads automatically upon package installation. Given that developer workstations and build pipelines increasingly host AI coding assistants, agent frameworks, and automated dependency-installation agents, a compromised package of this nature could be silently pulled in by autonomous or semi-autonomous agent-driven build/deploy workflows, leading to credential theft (npm tokens, cloud API keys, LLM provider keys) and RAT deployment on hosts that also run AI agent tooling.

Affected Systems

Node.js/npm development environments using Alibaba developer tooling; systems with internal/private packages sharing names with public unscoped packages; CI/CD pipelines and developer workstations running affected npm dependencies (Windows, macOS, Linux due to cross-platform RAT)

Indicators of Compromise

• Package name: lib-mtop
• Additional malicious npm packages (17 others, names not fully disclosed in source data)
• npm registry (public, unscoped namespace)

Remediation Steps

1. 1

   Audit npm Dependencies

   Immediately scan project package.json/package-lock.json files and CI/CD pipelines for 'lib-mtop' and any of the 18 identified malicious packages; remove and quarantine affected systems.

2. 2

   Enforce Scoped Private Packages

   Ensure internal/private packages use proper npm scopes (e.g., @alibaba/lib-mtop) and configure registry settings to prevent public package resolution from overriding scoped internal dependencies.

3. 3

   Implement Dependency Confusion Protections

   Use private registry proxying, package allow-listing, and lockfile integrity verification to prevent silent substitution of internal package names with public malicious lookalikes.

4. 4

   Rotate Credentials

   Rotate npm tokens, cloud provider credentials, API keys (including any LLM/agent service keys), and SSH keys on any system where the malicious packages were installed.

5. 5

   Deploy Endpoint Detection

   Scan and monitor developer workstations and build servers for RAT indicators, unusual outbound connections, and unauthorized remote access sessions.

6. 6

   Restrict Automated Agent Installations

   Review and restrict permissions for AI coding assistants or automation agents that can autonomously install npm packages, requiring human review or allow-listing before dependency installation.