Malware

node-ipc

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195Supply Chain CompromiseEvidence4

Peacenotwar, which RIAEvangelist has described as “protestware,” was then included as a dependency in node-ipc’s code, meaning some versions of node-ipc may come bundled with peacenotwar.

Execution

4 techniques

T1059Command and Scripting InterpreterEvidence1

If the current process has not already set the environment variable __ntw=1, the code attempts to fork the current module in a detached child process, passes __ntw=1 to that child, removes NODE_OPTIONS, ignores standard I/O, and returns control to the parent.

T1059.007JavaScriptEvidence1

Based on the location, a CLI log is left using post-install script with a message of support for Ukraine...

T1204User ExecutionEvidence1

CLI logs during and post installation of the package... actively run code on the machine to protest.

T1574Hijack Execution FlowEvidence1

The payload is not triggered by an npm life cycle script. It runs when the package's CommonJS entrypoint is loaded, such as through require("node-ipc").

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

The archive data path is more layered. The payload builds the tar archive, gzip-compresses it, converts the gzip bytes to base64 text, XORs that text with a SHA-256-derived keystream ... re-encodes the XORed bytes as base64, substitutes the base64 alphabet with a keyed shuffled alphabet, slices the transformed string into 31-character chunks, and hex-encodes each chunk before placing it into DNS labels.

T1070.004File DeletionEvidence2

This code that has been added to node-ipc@10.1.1 sets a timer, so that on every pre-configured random interval, of which a node-ipc related code is being called, it also executes a function, to what seems to be, making file system operations.

T1497Virtualization/Sandbox EvasionEvidence1

a very clear abuse and a critical supply chain security incident will occur for any system on which this npm package will be called upon, if that matches a geo-location of either Russia or Belarus

T1574Hijack Execution FlowEvidence1

The payload is not triggered by an npm life cycle script. It runs when the package's CommonJS entrypoint is loaded, such as through require("node-ipc").

Credential Access

5 techniques

T1528Steal Application Access TokenEvidence1

Examples include ... ~/.azure/accessTokens.json ... ~/.config/gh/hosts.yml ... Microsoft Teams LevelDB files

T1555Credentials from Password StoresEvidence1

Local desktop credential stores macOS Keychain databases, Firefox key databases, Linux keyrings, KWallet files, and Microsoft Teams LevelDB files

T1555.001KeychainEvidence1

Local desktop credential stores macOS Keychain databases ...

T1555.003Credentials from Web BrowsersEvidence1

Local desktop credential stores ... Firefox key databases ...

T1649Steal or Forge Authentication CertificatesEvidence1

Examples include ... ~/.ssh/id_rsa, ~/.ssh/id_ed25519 ...

Discovery

3 techniques

T1082System Information DiscoveryEvidence1

It collects environment variables, host information, /etc/hosts ... The archive contains: uname.txt: Output from uname -a, when available. etc/hosts: A copy of /etc/hosts, when readable. envs.txt: Sorted environment variables from the process.

T1083File and Directory DiscoveryEvidence2

attempts to wipe the hard drives of the system... deleting files

T1497Virtualization/Sandbox EvasionEvidence1

a very clear abuse and a critical supply chain security incident will occur for any system on which this npm package will be called upon, if that matches a geo-location of either Russia or Belarus

Collection

1 technique

T1560Archive Collected DataEvidence1

The payload then builds a collection archive. It manually creates tar entries, gzip-compresses the archive, writes a temporary *.tar.gz file under a process-specific temporary directory named like nt-<pid> ...

Command and Control

2 techniques

T1071.004DNSEvidence1

The exfiltration path is DNS-based ... sends archive metadata and body chunks as TXT lookup requests using generated names under bt.node.js ... The command and control (C2) channel uses DNS, not HTTP.

T1105Ingress Tool TransferEvidence1

New node-ipc@11.0.0 major version now includes the following: A dependency on peacenotwar module

Exfiltration

1 technique

T1048Exfiltration Over Alternative ProtocolEvidence1

The upload path then sets the resolver to the resolved endpoint and sends archive metadata and body chunks as TXT lookup requests using generated names under bt.node.js.

Impact

2 techniques

T1485Data DestructionEvidence3

some versions of “node-ipc,” the much more popular piece of software that RIAEvangelist maintains, started overwriting files on computers based in Russia and Belarus with a heart emoji

T1565Data ManipulationEvidence1

Overwrite of files on disk with protest information

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app5 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

thecyberexpress com vulnerabilitiesNews

May 15, 2026

Node-ipc Npm Package Hit By Credential Stealer Attack

Compromised node-ipc package releases contained obfuscated malware in the CommonJS implementation that fingerprinted systems, collected local files and secrets, compressed and encrypted stolen data, and exfiltrated it via DNS TXT queries. Earlier malicious versions also included destructive behavior targeting systems in Russia or Belarus.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

node-ipc

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195Supply Chain CompromiseEvidence4

Peacenotwar, which RIAEvangelist has described as “protestware,” was then included as a dependency in node-ipc’s code, meaning some versions of node-ipc may come bundled with peacenotwar.

Execution

4 techniques

T1059Command and Scripting InterpreterEvidence1

T1059.007JavaScriptEvidence1

Based on the location, a CLI log is left using post-install script with a message of support for Ukraine...

T1204User ExecutionEvidence1

CLI logs during and post installation of the package... actively run code on the machine to protest.

T1574Hijack Execution FlowEvidence1

The payload is not triggered by an npm life cycle script. It runs when the package's CommonJS entrypoint is loaded, such as through require("node-ipc").

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

T1070.004File DeletionEvidence2

T1497Virtualization/Sandbox EvasionEvidence1

a very clear abuse and a critical supply chain security incident will occur for any system on which this npm package will be called upon, if that matches a geo-location of either Russia or Belarus

T1574Hijack Execution FlowEvidence1

The payload is not triggered by an npm life cycle script. It runs when the package's CommonJS entrypoint is loaded, such as through require("node-ipc").

Credential Access

5 techniques

T1528Steal Application Access TokenEvidence1

Examples include ... ~/.azure/accessTokens.json ... ~/.config/gh/hosts.yml ... Microsoft Teams LevelDB files

T1555Credentials from Password StoresEvidence1

Local desktop credential stores macOS Keychain databases, Firefox key databases, Linux keyrings, KWallet files, and Microsoft Teams LevelDB files

T1555.001KeychainEvidence1

Local desktop credential stores macOS Keychain databases ...

T1555.003Credentials from Web BrowsersEvidence1

Local desktop credential stores ... Firefox key databases ...

T1649Steal or Forge Authentication CertificatesEvidence1

Examples include ... ~/.ssh/id_rsa, ~/.ssh/id_ed25519 ...

Discovery

3 techniques

T1082System Information DiscoveryEvidence1

T1083File and Directory DiscoveryEvidence2

attempts to wipe the hard drives of the system... deleting files

T1497Virtualization/Sandbox EvasionEvidence1

a very clear abuse and a critical supply chain security incident will occur for any system on which this npm package will be called upon, if that matches a geo-location of either Russia or Belarus

Collection

1 technique

T1560Archive Collected DataEvidence1

Command and Control

2 techniques

T1071.004DNSEvidence1

T1105Ingress Tool TransferEvidence1

New node-ipc@11.0.0 major version now includes the following: A dependency on peacenotwar module

Exfiltration

1 technique

T1048Exfiltration Over Alternative ProtocolEvidence1

The upload path then sets the resolver to the resolved endpoint and sends archive metadata and body chunks as TXT lookup requests using generated names under bt.node.js.

Impact

2 techniques

T1485Data DestructionEvidence3

some versions of “node-ipc,” the much more popular piece of software that RIAEvangelist maintains, started overwriting files on computers based in Russia and Belarus with a heart emoji

T1565Data ManipulationEvidence1

Overwrite of files on disk with protest information

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app5 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

thecyberexpress com vulnerabilitiesNews

May 15, 2026

Node-ipc Npm Package Hit By Credential Stealer Attack

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.