Do Son 
Loader malware gets delivered through several modules, implementing their part of the functionality | Image: Socket
At a glance
| Malware family | Unnamed cross-platform RAT (final payload “aone-cli”) |
| Threat actor | Unattributed; suspected Chinese-speaking actor |
| Target | Developers at Alibaba Group units, including Taobao, Tmall, and Alibaba Cloud |
| Delivery vector | Malicious npm packages impersonating private @ali-scoped packages |
| Key capabilities | Command execution, file transfer, recon, reverse TCP proxy, DingTalk lateral movement, AI-tool poisoning |
| Source | Socket Threat Research |
TL;DR
Socket uncovered an npm supply chain attack aimed at Alibaba Group developers. The campaign spread a cross-platform RAT through a cluster of npm packages. It stayed hidden for three months by splitting its loader across many innocent-looking modules.
Delivery
The attackers built lure packages with unscoped names that copy private @ali packages. That scope hosts Alibaba’s internal tooling. When a developer with access installs a lure, npm resolves the real private dependency and the malicious extras together.
Socket traced the lead to a package named lib-mtop. From there, the researchers found ten top-layer lures. Each one is empty, so scanners see nothing. Every lure depends on one middle-layer package, which pulls in the working loader code. The malicious packages saw few downloads, yet the targeted design raises the stakes.
Distributed loader
No single package looks harmful on its own. The actors published the pieces from several maintainer accounts to hide the links. Account creation and publish timestamps still tie them together. This npm supply chain attack turns benign-looking modules into one working loader.
Infection chain
The middle-layer package depends on two low-layer modules. One fetches a JSON config from an attacker-controlled GitHub repository. The other reads and evaluates that config. Together they form a quiet download-and-execute pattern.
The parser runs rules inside Node’s vm module, which suggests safe, isolated execution. In reality, one rule hides a payload. It uses a known Node.js vm sandbox-escape technique to reach the host process. The code then loads Node’s module system and pulls the next stage.
Later stages fingerprint the host and set persistence per platform. On macOS, the malware plants a background script and a scheduled Launch Agent. On Windows, it swaps the core of Alibaba‘s Alilang security app with a trojan copy. On Linux, it runs a memory-resident binary and deletes the file from disk.
Command-and-control and exfiltration
The final payload, dropped as “aone-cli,” is a cross-platform RAT. Aone is Alibaba‘s internal R&D platform, which underlines the targeted intent. The RAT checks in to a hardcoded controller and polls for commands.
Its features are broad. They include command execution, file upload and download, host recon, payload staging, and an encrypted reverse TCP proxy. It also performs DingTalk lateral movement and injects code to poison local AI tools. To blend in, it hosts stages on Alibaba Cloud and fakes DingTalk headers on its traffic.
Attribution stays suspected, not confirmed. The later stages carry Chinese-language comments, and commits use a China Standard Time offset. Still, Socket cautions these clues “shouldn’t be taken as a strong evidence of attribution.” The firm assesses motive as espionage, noting that “the goal of the campaign seems to be industrial espionage.” Socket also reports the infrastructure stayed active over three months after publication.
Defense and detection
This npm supply chain attack shows why teams need install-time scanning, not just version pinning. Anyone who installed an affected package should treat that machine as compromised. Socket advises cleaning up from a separate, trusted device, not the infected host.
Recommended steps
- Preserve forensic evidence before you remove anything.
- Find every developer machine that pulled the packages, then remove them.
- Rotate npm, GitHub, cloud, and CI/CD secrets from a clean system.
- Search developer machines for the campaign’s injection marker in Python files.
- Watch for outbound traffic that spoofs DingTalk Origin and Referer headers.
- Review DingTalk activity for signs of lateral movement.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
