A freshly published dependency is not safe just because it came from the maintainer. In this case, node-ipc 9.1.6, 9.2.3, and 12.0.1 are the payload, and the real blast radius is any developer workstation or CI job that loads them at runtime and exposes local secrets.
Socket says the bad versions were detected about three minutes after publication. The package code fingerprints the host, reads local files, and tries to exfiltrate developer and cloud secrets; StepSecurity says the trigger is runtime require, not a poisoned lockfile alone.
The contest around supply-chain compromises may be speeding up opportunistic malicious publishing. That makes package freshness a weaker trust signal and shifts the threat model toward secret exposure on machines and pipelines that executed the package.
Popular node-ipc npm package compromised to steal credentials
Hackers have injected credential-stealing malware into newly published versions of node-ipc, a popular inter-process communication package, in a new supply chain attack targeting npm.