Cybersecurity researchers have discovered a new set of malicious npm packages that target users of Alibaba developer tools with a cross-platform remote access trojan (RAT) as part of a sophisticated, targeted software supply chain attack targeting Chinese-speaking environments.
One of the packages in question is “lib-mtop,” an unscoped package with the same name as a private Alibaba package under the “@ali” scope. Although the npm package was first published sometime in November 2023 with no functionality, three new versions (v1.0.1, v1.0.2, and v1.0.3) were uploaded earlier this March and April.
It’s currently not clear if this was the result of a maintainer account takeover or the project developer opting to go rogue. Regardless of how the malicious changes were pushed, the newly added changes feature a loader that’s designed to fetch a remote JavaScript payload using curl and then execute it.
The same maintainer account “ch4ce,” which currently redirects to a “not found” error on npmjs[.]com, has also published four other packages: aone-kit, aone-kit-cli, aone-sandbox, and local-config-parser.
“The first three are empty wrappers that have the same name as private, @ali-scoped packages which they declare as a dependency in the package.json file,” Socket security researcher Karlo Zanki said in an analysis.
The last package, local-config-parser, implements a legitimate JSON configuration file parser, but features dependencies that, on their own, are innocuous and are published from other npm user accounts. When combined together, they serve as a conduit for an advanced RAT targeting developers who are likely working in companies that are part of the Alibaba Group.
Specifically, the malicious loader functionality is split and embedded into several packages delivered to the targets as part of the same dependency tree. The top-layer packages, which impersonate private packages from the @ali scope, serve as decoys that activate the installation of the dependency tree.
“When such a package is installed in an environment that has access to impersonated, scoped private packages, the dependency resolution works as expected, with a little extra functionality delivered through additional dependencies that get installed,” Socket explained.
As many as 10 top-layer lure packages have been found to depend on “smart-config-manager,” which functions akin to a middle-layer bridge that connects them to the malicious packages containing the loader logic. One of the low-layer packages proceeds to contact a GitHub repository to retrieve and store a rule engine configuration, and then it uses it to execute a malicious payload that then contacts a remote server to fetch secondary malware.
What’s notable about the attack is that the rule engine makes use of the vm module to implement the final phase and perform the payload download depending on the victim’s operating system. The payload is retrieved from a domain that masquerades as Alibaba (“aone-cli-next.oss-cn-beijing.aliyuncs[.]com”) to blend in and sidestep detection.
This stage performs a number of actions –
On Windows, it terminates the Alilang enterprise security, VPN, and office productivity app and replaces its core code with a trojanized version.
On Linux, it downloads a binary payload to /tmp, runs it as a detached process, and deletes the file from disk after it’s loaded into memory.
On macOS, it inserts a malicious background script into ~/.zshrc and sets up a 10-minute Launch Agent.
The final payload is a complex backdoor equipped with comprehensive command execution, arbitrary file upload and download, host reconnaissance, payload staging, and lateral movement capabilities. It also has the capacity to persist by injecting malicious code into common enterprise collaboration applications like DingTalk, Wukong, and Qoder.
Exactly who is behind the campaign is unknown, but the presence of Chinese language comments in the source code, combined with the fact that GitHub commits are timestamped with the UTC+08:00 offset, indicates that it’s possibly the work of a Chinese-speaking threat actor going after Chinese-speaking developers using tools belonging to Alibaba Group.
“The goal of the campaign seems to be industrial espionage,” Zanki noted. “While the number of downloads for the malicious packages is not significant, the impact of the campaign is hard to evaluate, because of the targeted nature and lateral-spread capabilities of the final-stage payload.”
The complete set of packages associated with the campaign is below –
lib-mtop
aone-kit
aone-kit-cli
aone-sandbox
local-config-parser
smart-config-manager
cloud-config-fetcher
fast-transform-pipeline
aone-cloud-cli
colder-cli
def-open-client
feedback-ai-sdk
flight-compare-analyzer
lwp-web-client
lzd-unified-station-sdk
open-worker-cli
test-skill-zip
uniapi-bridge
Users who have installed any of the above packages should assume compromise, rotate sensitive credentials from a clean machine, and audit developer systems for signs of suspicious activity.
The disclosure comes as unknown threat actors published a poisoned version of mrmustard (0.7.4), the photonic quantum computing Python library from Xanadu, to run an information stealer capable of harvesting SSH private keys, AWS credentials, and Kubernetes configurations, and exfiltrating them to an attacker server (“metrics.femboy[.]energy”).
According to StepSecurity, the payload runs on every package import. Further analysis indicates that the primary maintainer’s GitHub account was breached to push the rogue version by probing the project’s self-hosted CI runners and exfiltrating its publishing secrets to a webhook[.]site URL.
The malware “had three separate persistence mechanisms installed that keep a stealer running long after the package is uninstalled,” SafeDep said. “The credential theft targets research and HPC environments, collecting SLURM job queues and GPU inventories alongside the usual cloud secrets.”
📰 Original Source:TheHackerNews ✍️ Author: info@thehackernews.com (The Hacker News)
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
Leave a Reply