I work in IT Security as an security auditor and have experience analyzing security incident response practices. First of all:
If we complained to our cyber security experts, Alice may cause of
more harm to our organization.
You are missing the point. While it is true that reporting this person to your IT security team may trigger retaliation, a formal investigation needs to be done by the cybersecurity function both to stop the immediate damage and find out what other damage Alice may have done to your company. By not reporting this fraud / security incident to the proper authorities within your company, you are compounding the damage being done and not allowing security to do its job.
Mitigating retaliation by Alice
- Revoke all access to your company for Alice
The first step at mitigating retaliation is to revoke all access to your company that Alice may have had to limit the extent of harm she can do. This step would include procedures such as deactivating badges, changing passwords she was aware of, disabling domain accounts etc. Also if Alice had remote access (such as for vendor software support purposes), also remove that functionality.
- Review your other systems / software that Alice touched
What you have discovered may only be the tip of the iceberg. There may be other logic bombs / backdoors / malware etc. that Alice may have added to your company. Disgruntled vendors may plant malicious software into clients IT infrastructure to cause additional damage even after they are gone. If these have not been deleted / tampered with (assuming Alice is smart to hide her tracks), reviewing audit change logs would be a good first step.
- Inform senior management and legal counsel of your company
Your company has a serious liability here. You needs to terminate Alice immediately. From your description, Alice may not be rational, so it is wise to let your company senior management and legal counsel (if available) know so they can take additional preventative steps to mitigate damage. Assuming senior management and legal counsel are reasonable and care, they should be concerned.
Preventing future ocurrences
- Reviewing third party due diligence procedures prior to contracting
This event raises some questions as to why your company chose to purchase from Alice in the first place. What kind of due diligence was done into Alice's trustworthiness as a vendor? Who at your company authorized the relationship with Alice? From the limited information you gave, I would say strengthening vendor due diligence screening and risk management practices is a worthwhile effort. If management pushes back, point to this incident as to the consequences of lack of vendor due diligence. This reading may be useful as to what to consider when evaluating IT vendors.
- Security testing and signoff during QA process
This malicious code was apparently missed during the QA process prior to promoting the software purchased from Alice to production. Why? Is the code QA process inadequate? Are people in the QA testing function not competent? Something else? I feel it would be beneficial to review how you are testing the code , specifically non-functional requirements, to be deployed to production and perhaps suggesting improvements to management depending on your role in the company.