However, when the alarm goes off, and I break out of the eval, the system command is still running.

In most cases, creating a new process group will help here.  For example, something like this should work on POSIX-compliant systems (i.e. kill the entire tree of child processes):

if (my $pid = fork()) {
    wait;
    
} elsif (defined $pid) {
    setpgrp;   # create new process group
    eval {
        local $SIG{ALRM} = sub { die "alarm\n" };
        alarm 5;
        system 'bash -c "cat; echo"';   # run something (several proce
+sses) that hangs
        alarm 0;
    };
    if ($@ eq "alarm\n") {
        kill 9, 0;    # kill current process group
    }
    exit;
}
[download]

I said "in most cases", because in theory this approach will fail in case some subprocess should create another process group of its own, but practice shows this is only rarely done.

(Of course, you could wrap that up in a subroutine run_with_timeout(...), or something.)