Supply Chain Attack: Cross-Platform RAT via Malicious npm Packages Targeting Alibaba Tools

Introduction

Security Arsenal is tracking an active software supply chain attack targeting the npm ecosystem. Cybersecurity researchers have identified a cluster of 18 malicious npm packages engineered to deliver a cross-platform Remote Access Trojan (RAT). This campaign specifically targets users of Alibaba developer tools, with a focus on Chinese-speaking development environments.

The attack relies heavily on dependency confusion and typosquatting techniques. By mimicking legitimate internal or popular package names—notably lib-mtop, which shares its name with a private Alibaba package—threat actors are tricking developers into installing malicious dependencies. Once installed, the RAT establishes a persistent foothold, allowing for unauthorized remote access, data exfiltration, and lateral movement. Given the sophistication of the payload and the targeted nature of the campaign, immediate defensive action is required to audit development environments.

Technical Analysis

Affected Products and Platforms:

Platform: Node.js (Cross-platform: Windows, Linux, macOS)
Package Manager: npm (unscoped packages)
Targeted Software: Alibaba developer tools (users leveraging lib-mtop)

Attack Chain and Mechanics:

Initial Compromise (Supply Chain): Developers or automated build pipelines run npm install commands. Due to misconfigured package scopes or reliance on public repositories for internal packages, the npm client retrieves the malicious version of lib-mtop (and potentially 17 other unidentified variants) instead of the legitimate private module.
Payload Delivery: Upon installation, the package executes a postinstall script (or drops a payload within the node_modules directory). This payload is a cross-platform RAT, written likely in Node.js or a shell-agnostic compiled binary to ensure execution across different operating systems used by developers.
C2 and Persistence: The RAT establishes a connection to a Command and Control (C2) server. It may achieve persistence by modifying system startup scripts or injecting code into other Node.js processes running on the host.

Exploitation Status:

Status: Confirmed Active Exploitation. The packages are currently available in the public npm registry and are being downloaded by victims.
Vector: Dependency Confusion / Typosquatting.

Detection & Response

The following detection rules and hunt queries are designed to identify the installation of the known malicious package (lib-mtop) and the behavioral characteristics of the resulting RAT. Note that while lib-mtop is the only named IoC in the initial reporting, defenders should be alert for suspicious behavior from any recently installed low-popularity packages.

SIGMA Rules

YAML

---
title: Malicious npm Package Installation - lib-mtop
id: 8c4d2e15-1b3a-4a6f-9d8e-1f2a3b4c5d6e
status: experimental
description: Detects the installation of the malicious 'lib-mtop' npm package associated with a supply chain attack targeting Alibaba tool users.
references:
  - https://thehackernews.com/2026/08/18-malicious-npm-packages-deliver-cross.html
author: Security Arsenal
date: 2026/08/25
tags:
  - attack.initial_access
  - attack.supply_chain
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\node.exe'
    CommandLine|contains: 'npm install'
    CommandLine|contains: 'lib-mtop'
  condition: selection
falsepositives:
  - Legitimate use of a package named 'lib-mtop' (verify origin)
level: high
---
title: Node.js Spawning Shell Indicating RAT Activity
id: 9d5e3f26-2c4b-5b7g-0e9f-2g3b4c5d6e7f
status: experimental
description: Detects Node.js processes spawning command shells, a common behavior of cross-platform RATs delivered via malicious npm packages.
references:
  - https://thehackernews.com/2026/08/18-malicious-npm-packages-deliver-cross.html
author: Security Arsenal
date: 2026/08/25
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\node.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate build scripts or development tools
level: medium

KQL (Microsoft Sentinel)

KQL — Microsoft Sentinel / Defender

// Hunt for installation of the malicious lib-mtop package
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine contains "npm install"
| where ProcessCommandLine contains "lib-mtop"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| extend HostName = DeviceName

Velociraptor VQL

VQL — Velociraptor

-- Hunt for the presence of the lib-mtop package in node_modules
SELECT FullPath, Size, Mtime
FROM glob(globs='/*/node_modules/lib-mtop/**')
WHERE NOT IsDir

Remediation Script (Bash)

Bash / Shell

#!/bin/bash
# Audit and remediation script for malicious npm package 'lib-mtop'

echo "[+] Scanning for lib-mtop package..."

# Check current directory and subdirectories
if [ -d "node_modules/lib-mtop" ]; then
    echo "[!] ALERT: Malicious package lib-mtop found in $(pwd)."
    echo "[*] Attempting removal..."
    npm uninstall lib-mtop
    if [ $? -eq 0 ]; then
        echo "[+] Package removed successfully."
    else
        echo "[-] Manual removal required. Check package.."
    fi
else
    echo "[+] No threat found in current directory."
fi

# Optional: Audit package-lock. for the dependency
if [ -f "package-lock." ]; then
    if grep -q "lib-mtop" package-lock.; then
        echo "[!] WARNING: lib-mtop found in package-lock.. Review dependencies."
    fi
fi

Remediation

Immediate Actions:

Audit package. and package-lock.: Search for lib-mtop or any unrecognized dependencies. Remove them immediately.
Scope Configuration: Ensure internal packages are scoped properly (e.g., @alibaba/lib-mtop) and configure .npmrc to point to your internal registry exclusively for that scope to prevent dependency confusion.
Network Egress Control: Block outgoing connections from development build servers to known malicious IPs or non-standard ports associated with the C2 infrastructure (once identified).

Patch and Verification:

While there is no "patch" for a malicious package, the remediation is the complete removal of the package and a clean reinstall of legitimate dependencies from a trusted source.
Developers should rotate any credentials or API keys stored in environment variables that were active during the period the malicious package was installed.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub