Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
macOS: Inserts malicious background script into ~/.zshrc and sets up a 10-minute Launch Agent.
The final aone-cli payload is a remote access trojan... It can execute shell commands, upload and download files, collect host details, stage additional payloads, and create an encrypted reverse TCP proxy.
The malware in the lib-mtop package is a classic malicious loader fetching a hardcoded remote JavaScript payload using curl, and executing it via require() from the disk.
The attackers used a layered dependency chain in which top-level lure packages copied the names of private packages under Alibaba’s ali scope.
Additionally it performs silencing of logging mechanisms and cleanup of the malicious artifacts downloaded during previous stages of infection.
When a developer installed one of these lookalikes, additional dependencies supplied the downloader and rule-processing components.
Security teams should also identify every developer workstation that installed the affected dependencies... and monitor for connections to the listed command-and-control infrastructure. Reviewing requests that use forged DingTalk Origin and Referer headers can help uncover communications tied to this threat.
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cross-platform remote access trojan delivered via malicious npm packages impersonating Alibaba-related tooling. It profiles the host, deploys platform-specific payloads for macOS, Windows, or Linux, establishes persistence, executes commands, transfers files, collects host information, stages additional payloads, and can create an encrypted reverse TCP proxy. It also targets DingTalk, Wukong, and Qoder-related developer environments and can modify Python scripts for persistence and lateral movement.
Cross-platform remote access trojan used in a targeted npm supply-chain campaign against Alibaba-related developers. It performs host reconnaissance, command execution, file upload/download, payload staging, reverse TCP proxying, persistence via code injection, and lateral movement using DingTalk-related tooling.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.