Loading story…
Unknown threat actors conducted a targeted npm supply-chain campaign against developers using Alibaba Group internal tooling, publishing seemingly benign packages and lure packages that impersonated private @ali-scoped modules. The packages chained together loader components that fetched malicious configuration and later-stage payloads from attacker-controlled GitHub repositories and Alibaba Cloud infrastructure, then used a Node.js vm sandbox escape to reach the host process and install a cross-platform remote access trojan called aone-cli. The malware provided command execution, file transfer, persistence, reverse proxying, and DingTalk-enabled lateral movement, indicating an operation designed for long-term access rather than opportunistic abuse.
The intrusion established persistence differently across macOS, Windows, and Linux, including modifying ~/.zshrc, replacing the Alilang security application's app.asar, and launching a detached binary from /tmp on Linux. Reporting and associated indicators tie the activity to artifacts including aone-cli, aone-kit, app.asar, crypto.js, and setting.js, along with downloads hosted on Alibaba Cloud OSS and Function Compute services. The malware also tampered with AI-related tooling by patching Python scripts in .skills directories used by enterprise collaboration products such as DingTalk, Wukong, and Qoder, while the targeting and tradecraft point to a likely industrial espionage objective.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Socket disclosed a detailed analysis of the npm supply-chain campaign, describing its targeting of Alibaba developers, multi-package loader design, and the aone-cli RAT. The report said the campaign had remained active for more than three months and assessed a likely industrial espionage objective.
An attacker compromised a mrmustard maintainer GitHub account, abused the project's CI workflows to steal the PyPI publishing token, and uploaded a poisoned mrmustard 0.7.4 package to PyPI. The malicious artifact contained import-triggered credential theft and persistence code, while the GitHub source tree did not contain the injected payload.
As part of the final payload, the malware patched Python scripts in .skills directories tied to enterprise collaboration tools including DingTalk, Wukong, and Qoder. This expanded the intrusion beyond RAT deployment into tampering with AI-related tooling on affected systems.
The campaign used a Node.js vm sandbox escape to access the host process, download a third-stage loader, and deploy a cross-platform RAT named aone-cli. The malware enabled command execution, file transfer, persistence, reverse proxying, and DingTalk-based lateral movement, while also modifying systems differently across macOS, Windows, and Linux.
Unknown attackers staged a targeted npm supply-chain campaign in late April 2026 aimed at developers using Alibaba Group internal tooling and private @ali-scoped packages. The operation used multiple seemingly benign and impersonating npm packages to deliver loader functionality and fetch later-stage payloads from attacker-controlled GitHub and Alibaba Cloud infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 28 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecysecurity.news
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcesocket.dev
Open sourcestepsecurity.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers abused the npm account **`atool`**—linked to the maintainer of **`timeago.js`** and with publish rights across Alibaba’s **AntV** ecosystem—to push malicious releases into widely used JavaScript packages. Reporting from StepSecurity, SafeDep, Aikido Security, and CSO indicates the campaign affected packages including **`timeago.js`**, **`echarts-for-react`**, **`size-sensor`**, and numerous **`@antv/*`** libraries used for charting, graphing, rendering, mapping, and spreadsheet functions in web applications and dashboards. Researchers said the attacker published malicious code at scale, with one account citing **637 malicious versions across 317 packages in about 22 minutes**, while another identified **143 compromised packages** with affected versions. The payload was described as a **CI/CD credential stealer** and linked by some researchers to the **Mini-Shai-Hulud** worm, raising concern because the infected packages are commonly pulled into front-end builds and automated pipelines such as **GitHub Actions**, **GitLab CI**, and Kubernetes-hosted CI systems, where exposed tokens and cloud credentials could enable broader downstream compromise.
Jun 29, 2026
Security researchers reported multiple **software supply chain** campaigns targeting developers through malicious packages in public repositories, aiming to steal credentials/secrets and establish persistent access that can later impact production environments. Socket disclosed a campaign dubbed **StegaBin** involving **26 malicious npm packages** published over a two-day window that used a Pastebin “dead-drop” with **character-level steganography** to conceal C2 details, then resolved additional infrastructure across **31 Vercel deployments** to deliver platform-specific shell payloads that install a RAT and a **nine-module infostealer** targeting VSCode data, SSH keys, git repositories, browser credential stores, clipboard contents, and other local secrets. Socket assessed the tradecraft as consistent with activity previously attributed to **North Korea-aligned FAMOUS CHOLLIMA (Lazarus-linked)** and noted rapid detection of the packages shortly after publication. Separately, reporting highlighted **four malicious NuGet packages**—`NCryptYo`, `DOMOAuth2_`, `IRAOAuth2.0`, and `SimpleWriter_`—that targeted **ASP.NET** developers by exfiltrating **ASP.NET Identity** data (users/roles/permissions) and enabling backdoors; the packages were published in August 2024, accumulated **4,500+ downloads**, and were later removed. In that campaign, `NCryptYo` functioned as a dropper and proxy to an attacker-controlled C2, while `DOMOAuth2_` and `IRAOAuth2.0` handled data theft and backdoor rule delivery, and `SimpleWriter_` enabled file writing and hidden process execution while masquerading as a PDF utility. Other items in the set described unrelated C2 tooling trends (a Polygon blockchain-based botnet loader and the Vshell C2 framework) and do not describe the same package-repository supply chain incidents.
Jun 29, 2026
Security researchers reported two separate npm supply-chain compromises that delivered malware and exploit infrastructure to downstream users. One analysis uncovered an obfuscated Node.js stealer designed to run across **Windows via WSL, macOS, and Linux**, with plaintext modules for browser credential theft, recursive exfiltration of sensitive files, and a **WebSocket-based reverse shell**. The malware targeted Chromium-based browsers and cryptocurrency wallet extensions, sent browser data, files, and command traffic to `216.126.225.243` over ports `8085`, `8086`, and `8087`, and included host profiling plus an `HMAC-SHA256` routine with a hardcoded key. Researchers noted the command-and-control IP had previously been associated with **DPRK-linked OtterCookie** infrastructure. In a separate incident, Socket Threat Research said the widely used npm package **`art-template`** was compromised after repository control was transferred to an unknown actor, who inserted malicious remote-script loaders into versions **`4.13.5`** and **`4.13.6`**. The injected code redirected users to a watering-hole framework at `utaq.cfww.shop` that selectively targeted **Safari on iOS 11.0 through 17.2**, beaconed device and IP data to `l1ewsu3yjkqeroy.xyz`, and used anti-bot checks, anti-headless logic, and **WebAssembly-based fingerprinting** before retrieving gated payloads. Researchers found strong overlap with the **Coruna exploit kit**, including version-aware targeting, XOR obfuscation, architecture-specific dispatch, and a cutoff at **iOS 17.3**, with additional similarities noted to **UNC6691**.
Jun 29, 2026