Socket identified 18 npm packages that combined into a cross-platform remote-access trojan aimed at developers using Alibaba private tooling. Teams that installed any package in the cluster should treat the developer system as potentially compromised, not merely remove the dependency.
The campaign’s useful trick was division of labor. Several packages behaved as advertised when inspected alone. Together, their dependency graph fetched attacker-controlled configuration, evaluated a disguised rule, escaped a Node.js vm sandbox, and loaded platform-specific persistence and RAT stages. Socket said the infrastructure remained active more than three months after the packages were published.
Ordinary modules assembled the downloader
The top layer used unscoped names that imitated private packages from Alibaba’s unavailable @ali namespace. Ten lure packages depended on smart-config-manager, which in turn pulled cloud-config-fetcher and local-config-parser. The first downloaded a default preferences file from an attacker-controlled GitHub repository. The second parsed rules from that same file.
Each low-level module had plausible standalone behavior. The malicious function appeared only when the modules shared a dependency tree and a filename. A rule inside preferences.json wrapped downloader code between normal-looking calculations, then used items.constructor.constructor to obtain the global Function constructor. That escape reached Node.js process, recovered module-loading capability, and downloaded setting.js from Alibaba Cloud object storage.
Figure details
Unscoped lure packages imitating private Alibaba package names converge on smart-config-manager. Its dependencies fetch attacker-controlled preferences and evaluate a disguised rule. The rule escapes the Node.js vm sandbox to reach process and the module loader, then downloads later stages. The resulting RAT uses different persistence on macOS, Windows, and Linux and can inject AI-tool skills or move through DingTalk tooling.
The final stage changed with the operating system
After fingerprinting the host, the third-stage loader selected a platform path. On macOS it modified ~/.zshrc and created a ten-minute Launch Agent. On Windows it killed the official Alilang security application and replaced its app.asar with a trojanized copy. On Linux it launched a binary from /tmp, detached it, and deleted the file after loading it into memory.
The final aone-cli payload could execute shell commands, upload and download files, take screenshots, stage additional payloads, and establish an encrypted reverse TCP proxy. It also contained commands for AI-tool poisoning and DingTalk-oriented lateral movement. Socket found injection logic that patched Python files beneath .skills directories used by DingTalk, Wukong, and Qoder tooling.
Those findings support a targeted campaign assessment. Socket’s stated conclusion is: “The goal of the campaign seems to be industrial espionage.” The report does not identify an operator or a victim count. Chinese comments, UTC+0800 commit timestamps, Alibaba-themed packages, and tooling-specific persistence are targeting and language signals, not proof of attribution.
Hunt for the assembled behavior, not one package
Inventory package-lock files, npm caches, build logs, software-composition records, and endpoint process history for all 18 package names in Socket’s indicator list. Include direct and transitive dependencies. A clean current lockfile does not establish that an earlier install never ran.
On endpoints, search Python files beneath .skills directories for # __INJECT_MARKER__. Look for the ROBOT_UID environment variable with value 3201d407b7899a12d6d439950511c6a5, unexpected modifications to ~/.zshrc, unfamiliar Launch Agents with recurring execution, replacement of Alilang’s app.asar, and short-lived binaries launched from /tmp. Review Node.js processes that contacted xemzqli2vu[.]ai-app[.]pub, diamond-cli-znsxphqell[.]cn-shanghai[.]fcapp[.]run, aone-cli-next[.]oss-cn-beijing[.]aliyuncs[.]com, aone-ai-cli[.]oss-cn-beijing[.]aliyuncs[.]com, or aone-kit[.]oss-cn-beijing[.]aliyuncs[.]com, and review HTTP traffic carrying a forged Origin or Referer of https://alidocs.dingtalk.com.
Hash matches are high-value evidence where the files remain. Socket published SHA-256 values for the preferences file, setting.js, macOS, Linux, and Windows payloads, the dependency archive, and the separate lib-mtop branch. Absence of those hashes is not clearance: later stages could have been removed, and infrastructure can rotate.
Rotate secrets from a clean system
Preserve package metadata, lockfiles, npm cache entries, shell history, process and network telemetry, modified files, and DingTalk audit records before cleanup where incident response permits. Isolate affected developer systems and perform remediation from a separate trusted machine.
Rotate every credential that the affected environment could read: npm and GitHub tokens, cloud keys, CI/CD secrets, Vault and Kubernetes credentials, Docker credentials, SSH keys, and collaboration or messaging tokens. Review package-registry publication history, source-control access, CI jobs, cloud control-plane activity, and DingTalk actions for use after the earliest possible installation time. A token rotation without this scope review can leave attacker-created releases, keys, sessions, or automation intact.
Rebuild a system when the final-stage execution state cannot be bounded. Reinstall dependencies from reviewed lockfiles and trusted registries, then verify that none of the 18 names re-enter through transitive resolution.
Close on provenance, endpoint state, and account history
Verify every relevant lockfile, npm cache, build log, and software-composition record against Socket’s 18 package names, including transitive resolution. Inspect developer endpoints for the injection marker, the published ROBOT_UID value, OS-specific persistence, payload hashes, and listed network activity. Isolate or rebuild any host whose execution state cannot be bounded.
Rotate credentials readable by affected systems from a clean machine, then review registry, source-control, cloud, CI/CD, and DingTalk histories after the earliest possible install. Removal is incomplete while an attacker-created token, release, session, key, or automation remains valid.
Close the package exposure only when every relevant repository and developer or build system has been checked for direct and transitive installation, the malicious names are absent from approved dependency graphs, and registry controls prevent their return. Close the endpoint incident only when persistence locations, the injection marker, environment value, payload hashes, network indicators, and DingTalk activity have been resolved or their telemetry gaps documented.
Finally, close the credential exposure when secrets readable by affected systems have been rotated from a clean machine and their use histories have been reviewed for unauthorized access. If install-time or endpoint telemetry is missing, record that uncertainty and rebuild rather than treating package deletion as proof that the RAT never assembled.