- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,375
The story began with a quiet publication of three versions, but quickly turned into a wake-up call for the entire ecosystem.
In the npm ecosystem, the risk surfaced again, which is especially dangerous for developers and DevOps teams: malicious code did not get into a new dubious package, but in a well-known node-ipc library. Three published versions tried to collect local files, keys, and cloud accounts, and then transfer stolen data to an external server.
Socket and StepSecurity have confirmed malicious behavior in node-ipc[#0.1.6, node-ipc[@]9.2.3, and node-ipc[@]12.0.1. According to them, the code was strongly obfuscated and started when connecting the package during the application. The malware module checked the environment, searched for files with secrets, packed the found data in the GZIP archive and sent them to the domain sh.azurestnomicwidider.
About 90 categories of data were at risk, including Amazon Web Services, Google Cloud and Microsoft Azure, SSH Keys, Kubernetes Tokens, GitHub CLI settings, Claude AI and Kiro IDE, Terraform states, database passwords, and team line history. Such a set shows that the attack was aimed not at ordinary user data, but at access through which you can develop an attack within the infrastructure.
The version was published by the atierant account. He was listed among the accompanying node-ipc, but had not previously released updates for the package and was not associated with the original author, known as Ria Evangelist. The previous update of node-ipc was released in August 2024, so the appearance of malicious releases after 21 months of downtime looks like a compromise of an account or a pre-prepared addition of a new accompanying.
The peculiarity of the attack is that the malicious code did not use standard npm scenarios like preinvest, install or post-startall. Instead, the payload was added to the end of the node-ipc.cjs file and ran every request ('node-ipc'). A similar technique – the introduction of the code into the main file of the package bypassing the standard scripts of the installation – has already been used in attacks on the supply chain this year.
In version 12.0.1 found an additional check on SHA-256. According to the expert Stepsecurity Syej Likhita, the code was triggered only by machine, where the main path of the module coincided with a predetermined value. This indicates a targeted attack against a particular project or developer. In versions 9.x, there was no such restriction, so the code was run on any system where the package was connected.
The authors of the report also described the second channel of data output through DNS TXT-requests. The malware code bypassed the local DNS settings, first accessed the public rezollers, and then redirected requests directly to the server. Such a technique prevents companies from noticeing a leak if monitoring is built only on corporate DNS magazines.
Users of node-ipc are advised to delete versions 9.1.6, 9.2.3 and 12.0.1, switch to checked 9.2.1 or 12.0.0, replace all the secrets that could be on infected machines, check the NPm, CI/CD and cloud services, and block outgoing traffic to the control domain.
In the npm ecosystem, the risk surfaced again, which is especially dangerous for developers and DevOps teams: malicious code did not get into a new dubious package, but in a well-known node-ipc library. Three published versions tried to collect local files, keys, and cloud accounts, and then transfer stolen data to an external server.
Socket and StepSecurity have confirmed malicious behavior in node-ipc[#0.1.6, node-ipc[@]9.2.3, and node-ipc[@]12.0.1. According to them, the code was strongly obfuscated and started when connecting the package during the application. The malware module checked the environment, searched for files with secrets, packed the found data in the GZIP archive and sent them to the domain sh.azurestnomicwidider.
About 90 categories of data were at risk, including Amazon Web Services, Google Cloud and Microsoft Azure, SSH Keys, Kubernetes Tokens, GitHub CLI settings, Claude AI and Kiro IDE, Terraform states, database passwords, and team line history. Such a set shows that the attack was aimed not at ordinary user data, but at access through which you can develop an attack within the infrastructure.
The version was published by the atierant account. He was listed among the accompanying node-ipc, but had not previously released updates for the package and was not associated with the original author, known as Ria Evangelist. The previous update of node-ipc was released in August 2024, so the appearance of malicious releases after 21 months of downtime looks like a compromise of an account or a pre-prepared addition of a new accompanying.
The peculiarity of the attack is that the malicious code did not use standard npm scenarios like preinvest, install or post-startall. Instead, the payload was added to the end of the node-ipc.cjs file and ran every request ('node-ipc'). A similar technique – the introduction of the code into the main file of the package bypassing the standard scripts of the installation – has already been used in attacks on the supply chain this year.
In version 12.0.1 found an additional check on SHA-256. According to the expert Stepsecurity Syej Likhita, the code was triggered only by machine, where the main path of the module coincided with a predetermined value. This indicates a targeted attack against a particular project or developer. In versions 9.x, there was no such restriction, so the code was run on any system where the package was connected.
The authors of the report also described the second channel of data output through DNS TXT-requests. The malware code bypassed the local DNS settings, first accessed the public rezollers, and then redirected requests directly to the server. Such a technique prevents companies from noticeing a leak if monitoring is built only on corporate DNS magazines.
Users of node-ipc are advised to delete versions 9.1.6, 9.2.3 and 12.0.1, switch to checked 9.2.1 or 12.0.0, replace all the secrets that could be on infected machines, check the NPm, CI/CD and cloud services, and block outgoing traffic to the control domain.
