A new set of malicious npm packages were discovered targeting users of Alibaba developer tools with a cross-platform remote access trojan (RAT). This sophisticated software supply chain attack specifically targets Chinese-speaking environments, based on information published by The Hacker News.The attack utilizes packages with names mimicking private Alibaba packages, such as 'lib-mtop.' These packages, published by a maintainer account named 'ch4ce,' function as decoys that initiate the installation of a malicious dependency tree. The loader functionality is split across several packages, ultimately fetching and executing a remote JavaScript payload using curl. The final payload is a complex backdoor capable of command execution, file transfer, host reconnaissance, and lateral movement. It can also achieve persistence by injecting code into enterprise applications like DingTalk and Wukong. The attack infrastructure masquerades as Alibaba services to evade detection. The threat actor's use of Chinese language comments and specific UTC offsets suggests a Chinese-speaking origin, likely aiming for industrial espionage. Developers who have installed any of the identified malicious packages should assume compromise, rotate credentials from a clean machine, and audit their systems.Source: The Hacker News
