GCVE-110-OSM-2026-9303

Top-layer lure package in the distributed npm cluster delivering a cross-platform RAT to Alibaba developers. Impersonates a private, internal @ali-scoped Alibaba package by publishing the same name unscoped on the public registry, so a resolution mistake or misconfigured registry pulls the attacker's copy instead (dependency confusion). Published by the aone_code account on 2026-04-28/29. STILL LIVE on npm - not unpublished, unlike the ch4ce-account packages in the same cluster. Publisher: aone_code <aone_code@outlook.com>. Impersonation target: private @ali-scoped internal package 'feedback-ai-sdk'. Delivery chain: npm package -> .cloud-preferences.json rules (stage 2, Node vm sandbox escape via items.constructor.constructor -> F('return process')()) -> setting.js (stage 3, platform fingerprinting) -> aone-cli (stage 4, cross-platform RAT). Stage-4 RAT command set: info, sleep, pwd, whoami, ipconfig/ifconfig, dir/ls, cat, read, screenshot, download, upload, pull, execute, run_python, proxy, aisearch, install_python_module, install_node_module, aipoison, aipoison_inject, aipoison_deploy, dws_lateral, exit, plus unrestricted shell forwarding. Persistence - macOS: appends a background script to ~/.zshrc and installs a 10-minute LaunchAgent. Windows: terminates the official Alilang security agent and replaces its app.asar with a trojanised copy. Linux: stages a binary in /tmp, runs it detached, then unlinks it so it lives only in memory. Application persistence: injects Python marked with '# __INJECT_MARKER__' into the .skills directories of DingTalk, Wukong and Qoder to pull a remote script.js. C2: xemzqli2vu.ai-app.pub, with an encrypted reverse TCP proxy over WebSocket to diamond-cli-znsxphqell.cn-shanghai.fcapp.run. Requests are disguised with forged Origin/Referer headers set to https://alidocs.dingtalk.com. Agent identifier observed: ROBOT_UID=3201d407b7899a12d6d439950511c6a5.