Security researchers at Socket have uncovered 18 malicious npm packages designed to compromise developers who use private Alibaba developer tools. The core package — lib-mtop — shares its name with a legitimate private package published under the @ali scope inside Alibaba Group. The account that pushed the malicious versions, ch4ce, originally uploaded lib-mtop in November 2023 with no functionality, then silently added a malicious loader in three new versions (v1.0.1, v1.0.2, v1.0.3) uploaded in March and April 2026. Whether this was an account compromise or a rogue maintainer, the effect is the same: any developer whose project depends on this package is served a remote JavaScript payload that installs a cross-platform remote access trojan (RAT).
The attack is carefully staged to avoid detection. The RAT’s loader code is fragmented across the dependency tree — no single package contains the complete malicious logic. Four additional packages from the same maintainer account (aone-kit, aone-kit-cli, aone-sandbox, and local-config-parser) act as carriers, each mimicking Alibaba-internal tools. When a developer installs any of the top-level packages in an environment that has legitimate access to Alibaba’s private @ali-scoped registry, the dependency chain assembles, the loader fires, and a full RAT is installed on the victim’s machine — giving the attacker persistent remote control, likely with the intent of pivoting into Alibaba Group infrastructure via the developer’s credentials.
How to check if you’re affected
Affected versions include lib-mtop v1.0.1, v1.0.2, and v1.0.3, plus aone-kit, aone-kit-cli, aone-sandbox, and local-config-parser from the ch4ce maintainer account. Run npm ls lib-mtop aone-kit aone-kit-cli aone-sandbox local-config-parser in any Node.js project to check for the affected packages. If you work in an environment with access to Alibaba’s internal @ali-scoped packages, check your full dependency tree for unexpected scoped-to-unscoped name collisions. The ch4ce account on npmjs.com now resolves to a “not found” error, but the packages may still be cached in your registry mirror.