title: Potential Malicious NPM Package Installation (lib-mtop/aone-cli)
id: 1b2c3d4e-5f6a-4b3c-2d1e-0f9e8d7c6b5a
status: experimental
description: Detects the installation of known malicious npm packages associated with the Alibaba supply chain attack.
references:
    - https://otx.alienvault.com/pulse/678910
author: Security Arsenal
date: 2026/07/29
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\npm.exe'
        CommandLine|contains:
            - 'install'
            - 'i '
    filter_main:
        CommandLine|contains:
            - 'lib-mtop'
            - 'aone-cli'
            - 'smart-config-manager'
            - 'cloud-config-fetcher'
            - 'aone-kit'
    condition: selection and filter_main
falsepositives:
    - Legitimate use of these specific package names (highly unlikely given context)
level: critical
---
title: Network Connection to Malicious Alibaba OSS/FC Infrastructure
id: 2c3d4e5f-6a7b-5c4d-3e2f-1a0b9c8d7e6f
status: experimental
description: Detects outbound network connections to known malicious payload hosting and C2 infrastructure used in this campaign.
references:
    - https://otx.alienvault.com/pulse/678910
author: Security Arsenal
date: 2026/07/29
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|contains:
            - 'fcapp.run'
            - 'aone-cli-next.oss-cn-beijing.aliyuncs.com'
            - 'aone-ai-cli.oss-cn-beijing.aliyuncs.com'
            - 'aone-kit.oss-cn-beijing.aliyuncs.com'
    condition: selection
falsepositives:
    - Legitimate traffic to Alibaba Cloud Function Compute (unlikely for generic enterprise endpoints)
level: high
---
title: File Creation - Malicious NPM Package Artifacts
id: 3d4e5f6a-7b8c-6d5e-4f3a-2b1c0d9e8f7a
status: experimental
description: Detects the creation of directories or files associated with the malicious npm package dependency chain.
references:
    - https://otx.alienvault.com/pulse/678910
author: Security Arsenal
date: 2026/07/29
logsource:
    category: file_create
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - '\node_modules\lib-mtop'
            - '\node_modules\aone-cli'
            - '\node_modules\smart-config-manager'
            - '\node_modules\aone-kit'
    condition: selection
falsepositives:
    - Developer systems legitimately installing these packages (verify context)
level: critical

// Hunt for network connections to known malicious infrastructure
DeviceNetworkEvents
| where RemoteUrl has "aliyuncs.com" 
| where RemoteUrl has_any ("aone-cli", "aone-kit", "lib-mtop") 
| summarize Count=count() by DeviceName, RemoteUrl, AccountSid 
| order by Count desc

// Hunt for process execution involving npm install with suspicious packages
DeviceProcessEvents 
| where FileName in~ ("npm.cmd", "npm.exe", "node.exe") 
| where ProcessCommandLine has_any ("install", "i ") 
| where ProcessCommandLine has_any ("lib-mtop", "aone-cli", "smart-config-manager", "cloud-config-fetcher") 
| project DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, Timestamp

# IOC Hunt: NPM Supply Chain Typosquatting (lib-mtop / aone-cli)
# Scans local drives for node_modules containing the malicious packages.

$MaliciousPackages = @("lib-mtop", "aone-cli", "smart-config-manager", "cloud-config-fetcher", "aone-kit")
Write-Host "[+] Scanning for malicious npm packages..." -ForegroundColor Cyan

Get-PSDrive -PSProvider FileSystem | ForEach-Object {
    $Drive = $_.Root
    Write-Host "Scanning $Drive..." -ForegroundColor DarkGray
    
    try {
        $NodeModules = Get-ChildItem -Path $Drive -Directory -Recurse -ErrorAction SilentlyContinue -Filter "node_modules" | Select-Object -First 50 # Limit depth for performance
        
        foreach ($Mod in $NodeModules) {
            foreach ($Pkg in $MaliciousPackages) {
                $TargetPath = Join-Path $Mod.FullName $Pkg
                if (Test-Path $TargetPath) {
                    Write-Host "[!] MALICIOUS PACKAGE FOUND: $TargetPath" -ForegroundColor Red
                    # Optional: Remove-Item -Path $TargetPath -Recurse -Force
                }
            }
        }
    } catch {
        # Ignore access errors
    }
}

Write-Host "[+] Scan complete." -ForegroundColor Green


# Response Priorities

*   **Immediate:**
    *   Block all identified OSS URLs and the `diamond-cli-znsxphqell.cn-shanghai.fcapp.run` hostname at the proxy and firewall.
    *   Scan artifact repositories (npm, Artifactory) for the presence of `lib-mtop`, `aone-cli`, and related packages. Delete any versions found.
*   **24h:**
    *   Identify all developers who have executed `npm install` within the last 48 hours.
    *   Run the PowerShell hunt script on developer workstations and build servers to detect local artifacts.
    *   Rotate API keys and credentials stored in environments where these packages were installed, as the RAT is designed for theft.
*   **1 Week:**
    *   Implement strict package allow-listing (npm allowlists) for the internal developer environment.
    *   Review `package-lock.` files in code repositories to ensure no typosquatted dependencies were committed.