Malicious npm packages split a RAT across files to slip past code review

Researchers at Socket found 18 malicious npm packages that deliver a cross-platform remote access trojan to users of Alibaba developer tools, splitting the attack across many packages so each looks harmless on its own. Ten lure packages with no real function depend on a bridge package, which pulls in loaders that fetch a rule-engine configuration from GitHub and use it to run OS-specific payloads from a server disguised as Alibaba infrastructure. On Windows it even replaces a legitimate Alibaba security app with a trojanized copy. The final trojan can steal data, run commands, and move laterally, and the campaign stayed hidden for about three months.

Check

Analyze dependency trees as a whole rather than one package at a time, since this campaign hid its logic across lure, bridge, and loader packages that each look benign in isolation.

Affected

Developers using Alibaba tooling who installed the malicious packages; the fragmented loader assembles a remote access trojan that steals data, runs commands, and moves laterally, evading per-package review.

Fix

Vet dependencies and their transitive graph, watch for packages that only pull in others or fetch configuration from external repositories, pin trusted versions, and monitor developer machines for unexpected outbound connections.