Vulnerabilities · 122 days ago
A freshly published dependency is not safe just because it came from the maintainer. In this case, node-ipc 9.1.6, 9.2.3, and 12.0.1 are the payload, and the real blast radius is any developer workstation or CI job that loads them at runtime and exposes local secrets.
Socket says the bad versions were detected about three minutes after publication. The package code fingerprints the host, reads local files, and tries to exfiltrate developer and cloud secrets; StepSecurity says the trigger is runtime require, not a poisoned lockfile alone.
The contest around supply-chain compromises may be speeding up opportunistic malicious publishing. That makes package freshness a weaker trust signal and shifts the threat model toward secret exposure on machines and pipelines that executed the package.
6 sources covering this story
Popular node-ipc npm package compromised to steal credentials
Hackers have injected credential-stealing malware into newly published versions of node-ipc, a popular inter-process communication package, in a new supply chain attack targeting npm.
Malicious node-ipc Versions Published to npm | Snyk
Malicious node-ipc versions on npm may have stolen credentials from developer and CI/CD environments.
Stealer Backdoor Found in 3 Node-IPC Versions Targeting Developer Secrets
Three node-ipc versions contain stealer/backdoor code, exposing developer and cloud secrets to exfiltration.
Popular node-ipc npm Package Infected with Credential Steale...
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.
An analysis of backdoored node-ipc npm releases that add an obfuscated credential collection and DNS exfiltration payload to the CommonJS entrypoint.
Not Your IPC, but node-ipc: npm Hit Again with Supply Chain Attack (But This Time It's Not a Worm)
Newly published versions of the node-ipc npm package briefly contained an obfuscated infostealer that harvested developer credentials, cloud tokens, SSH keys, CI/CD secrets, and local configuration files before attempting DNS-based exfiltration.
Part of the PlainSec briefing for 2026-05-14