2026-09-23 · SaaS security
The lib-mtop npm campaign: why lockfiles do not catch a decoy package
Socket's Karlo Zanki traced a cluster of 18 malicious npm packages that impersonated Alibaba developer tools and delivered a cross-platform remote access trojan. The Hacker News summarized the campaign on August 3, 2026. One of the packages was lib-mtop, an unscoped name that matches a private @ali package.
Dependabot would not have helped. There was no CVE. The packages were purpose-built.
How the dependency tree did the work
lib-mtop first appeared on npm in November 2023 as an empty package. Versions 1.0.1 through 1.0.3 landed in March and April 2026 with a loader that fetched a remote JavaScript payload over curl and ran it.
The same maintainer account, ch4ce, published decoys such as aone-kit, aone-kit-cli, and aone-sandbox: empty wrappers that share names with private @ali-scoped packages and declare those scoped packages as dependencies. Socket's analysis: when you install the decoy in an environment that can reach the real private package, resolution looks normal, and extra dependencies arrive with it.
Those extras include smart-config-manager, a middle layer that about ten top-level lures depend on. Lower in the tree, pieces that look harmless on their own assemble a loader. One stage pulls a rule-engine config from GitHub, then uses Node's vm module to pick a payload by operating system from a host that mimics Alibaba (aone-cli-next.oss-cn-beijing.aliyuncs.com).
On Windows the payload killed Alilang and replaced its core with a trojaned copy. On Linux it dropped a binary in /tmp, ran it detached, and deleted the file after it was in memory. On macOS it wrote into ~/.zshrc and installed a Launch Agent on a ten-minute timer. The final backdoor could run commands, move files, and persist inside collaboration apps such as DingTalk.
Zanki's read is industrial espionage, aimed at Chinese-speaking developers in the Alibaba ecosystem. Download counts were not large. The blast radius is hard to measure because the last stage can move laterally.
The 18 package names Socket and The Hacker News listed include lib-mtop, smart-config-manager, local-config-parser, aone-kit, aone-kit-cli, aone-sandbox, and a dozen other lures. Anyone who installed them should treat the machine as compromised and rotate credentials from a clean host.
What this means if you are not Alibaba
The tactic is not specific to one vendor. Publish an unscoped package that shares a name with a private scoped dependency. Split the malware so no single package looks like a RAT. Hide the second stage behind a hostname that looks like the target's cloud.
SaaS teams hit this two ways. Engineers install the wrong package because the name matches something they already use internally. Or a plugin, a customer upload, or a CI job pulls a dependency tree you never reviewed as a unit.
Scanners that only flag known CVEs miss this class. They do not ask whether postinstall calls curl, whether three boring packages become a loader when installed together, or whether your lockfile still allows an unscoped name to sneak in next to a scoped one.
What to change in the build
Pin and enforce the lockfile. Fail the build if the install does not match it.
Set ignore-scripts by default. Review install scripts before you turn them back on. Most libraries do not need them.
Generate an SBOM per production build so you can answer "did we ever pull lib-mtop" without archaeology.
Keep customer-uploaded or plugin builds off the same runners that hold production credentials. Alert on unexpected outbound hosts during npm install.
At Faultline Security we include dependency and CI review in web application penetration tests for European B2B SaaS companies. If you want to know whether a decoy package would survive your pipeline, get in touch.