Loading story…
Several newly published versions of the widely used npm package node-ipc were found to be malicious after being released through the legitimate maintainer account, turning a trusted dependency into an active software supply chain attack. Researchers identified node-ipc@9.1.6, 9.2.3, and 12.0.1 as compromised, with the payload embedded in the package’s CommonJS bundle so it executed when applications loaded the library while normal functionality continued. Security firms said any project installing the package directly or transitively could be affected, and described the code as an obfuscated stealer and backdoor that fingerprints hosts, reads local files, and attempts covert data theft.
Analysis indicates the malware harvested environment variables and secrets from developer workstations, CI/CD pipelines, cloud platforms, Kubernetes, Docker, SSH configurations, browser profiles, and AI tooling, then compressed, encrypted, and exfiltrated the data through DNS TXT queries using public resolvers and attacker-controlled infrastructure including azurestaticprovider.net, sh.azurestaticprovider.net, bt.node.js, and 37.16.75.69. Investigators said the use of the legitimate maintainer account points to either account compromise or insider abuse, while the campaign appears focused on infrastructure-aware credential theft rather than disruption. Defenders were urged to remove the affected versions from manifests and lockfiles, pin to known-clean releases, audit systems that installed them, and rotate all secrets exposed in any impacted CI/CD environment.
Trace attribution and downstream blast radius.
7 events from the most recent confirmed update back to the earliest known activity.
Investigators said the node-ipc compromise may have begun when attackers took over a dormant npm maintainer account tied to an expired email domain that was re-registered in May 2026. This provided a plausible explanation for how malicious versions 9.1.6, 9.2.3, and 12.0.1 were published through the legitimate maintainer account.
On 2026-05-14, StepSecurity reported that the malicious node-ipc version 12.0.1 included a SHA-256 fingerprint check that made the payload inert except on a specific targeted environment. In contrast, the malicious 9.x releases were described as broadly executing, indicating different targeting behavior across the compromised versions.
By 2026-05-14, deeper analysis showed the malicious code was appended to the CommonJS bundle node-ipc.cjs and harvested secrets from developer systems, CI/CD, cloud, Kubernetes, Docker, SSH, browser profiles, and AI tooling. Upwind reported that the malware compressed and encrypted stolen data, exfiltrated it via DNS TXT queries using public resolvers, and tied the activity to infrastructure including azurestaticprovider.net, sh.azurestaticprovider.net, bt.node.js, and 37.16.75.69.
Initial reverse engineering on 2026-05-14 found that the compromised package contained an obfuscated payload that executed when node-ipc was required at runtime. Researchers said it could fingerprint hosts, read local files, steal developer and cloud secrets, and attempt exfiltration to attacker-controlled infrastructure.
Shortly after publication on 2026-05-14, security researchers at Socket and StepSecurity reported that the new node-ipc releases were malicious and warned that projects installing them directly or transitively were affected. They advised developers to remove the affected versions, pin to known-clean releases, and audit impacted environments.
On 2026-05-14, malicious releases of the widely used npm package node-ipc were published through the legitimate maintainer account atiertant. The compromised versions identified across reports were 9.1.6, 9.2.3, and 12.0.1.
In March 2022, node-ipc maintainer Brandon Nozaki Miller intentionally introduced protestware into multiple package releases, including destructive file corruption in versions 10.1.1 and 10.1.2 for systems geolocated in Russia or Belarus. Later releases 11.0.0, 11.1.0, and 9.2.2 pulled in the peacenotwar dependency, spreading disruptive behavior transitively to downstream projects such as Vue.js CLI.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
14 references tracked. Mallory keeps watching after this page renders.
thecyberexpress.com
Open sourcebleepingcomputer.com
Open sourcescworld.com
Open sourcesnyk.io
Open sourcethreats.wiz.io
Open sourcestepsecurity.io
Open sourcesnyk.io
Open sourcesnyk.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The npm package **`node-ipc`** was turned into a supply-chain security incident after its maintainer added the **`peacenotwar`** dependency to releases **`11.0.0`** and **`9.2.2`**, leading to the assignment of **`CVE-2022-23812`**. Reports said the affected code queried **`ipgeolocation.io`** to determine whether a system was located in Russia or Belarus and, on matching hosts, traversed directories and overwrote files with a heart emoji. The issue drew broad scrutiny because `node-ipc` was widely used in downstream JavaScript and Node.js projects, raising concerns that a politically motivated change in a popular open source package could propagate destructive behavior through software supply chains. The maintainer described **`peacenotwar`** as "protestware" intended as a response to Russia's invasion of Ukraine and publicly framed it as non-destructive, while outside reporting and security writeups characterized the incident as sabotage and warned of file-wiping behavior. Published mitigations advised organizations to avoid the affected `node-ipc` versions, pin to **`9.2.1`** or **`10.1.0`**, and use dependency controls such as package overrides or Yarn resolutions to block the malicious releases from being pulled into builds.
Aug 15, 2026
Security researchers have uncovered multiple campaigns involving malicious npm packages designed to steal developer credentials and sensitive information from Windows, macOS, and Linux systems. In one operation, ten typosquatted packages impersonated popular libraries such as TypeScript, discord.js, ethers.js, and others, using sophisticated obfuscation, fake CAPTCHA prompts, and postinstall hooks to deploy an information stealer that harvested credentials from system keyrings, browsers, and authentication services. The malware executed in a new terminal window to evade detection and sent stolen data, including IP addresses, to external servers. Another large-scale campaign, dubbed 'PhantomRaven,' involved 126 npm packages and over 86,000 downloads, targeting authentication tokens, CI/CD secrets, and GitHub credentials. These packages leveraged remote dynamic dependencies to fetch and execute payloads during installation, profiling infected devices and exfiltrating secrets for potential supply chain attacks. The attackers employed techniques such as slopsquatting, where AI-generated package recommendations led developers to install non-existent, malicious packages. Some packages impersonated tools from GitLab and Apache, and many remained available on npm at the time of reporting. The campaigns highlight the ongoing risks in the npm ecosystem, with attackers exploiting both user trust and platform weaknesses to compromise developer environments and CI/CD pipelines. Security experts warn that the theft of tokens and credentials could enable further attacks, including the introduction of malicious code into legitimate projects and broader supply chain compromises.
Jun 29, 2026
A software supply chain compromise hit the JavaScript ecosystem after malicious versions of **Keyv** and related npm packages were published through legitimate maintainer workflows, with `keyv@6.0.0` identified as a primary malicious release. Researchers said the tainted packages added a `preinstall` hook that executed attacker code during dependency installation on developer workstations and CI runners, while some repositories also contained malicious **VS Code** and **Claude Code** configuration files that could trigger execution when a cloned project was opened. Early community reports tied the incident to the `jaredwray/cacheable` package set and warned that numerous downstream dependencies were exposed. Analysis found the malware targeted high-value secrets including **GitHub** and **npm** tokens, cloud credentials, Vault tokens, Kubernetes service account tokens, SSH keys, and TLS certificates, with tradecraft resembling the **Shai-Hulud** malware family. Investigators reported no evidence that npm itself was breached; instead, the attackers appear to have used stolen maintainer credentials and trusted GitHub Actions publishing pipelines with valid provenance and npm attestation, demonstrating that provenance verified the build source but not whether the source had already been maliciously altered. Responders were urged to avoid affected versions, isolate any host that installed them, remove persistence such as `gh-token-monitor`, and rotate exposed credentials from a clean system.
Aug 8, 2026