Popular node-ipc npm Library Hit by Supply Chain Attack, Impacting 822K Weekly Downloads

A widely used npm package with more than 822,000 weekly downloads has once again become the center of a serious supply chain attack, raising fresh concerns across the JavaScript ecosystem.

Security researchers at Socket have uncovered multiple malicious versions of the popular node-ipc library containing stealthy credential-stealing malware and backdoor capabilities.

The affected versions, node-ipc@9.1.6, 9.2.3, and 12.0.1, were flagged within minutes of publication.

According to Socket, the malicious code is heavily obfuscated and designed to collect sensitive data from developer environments and CI pipelines silently, then exfiltrate it through covert DNS channels.

node-ipc Supply Chain Attack

Unlike traditional npm attacks that rely on typosquatting or install-time scripts, this campaign embeds its payload directly into the CommonJS entry point (node-ipc.cjs). The malicious code executes automatically when the package is required, making it harder to detect.

Once triggered, the malware:

• Fingerprints the host system using OS-level data
• Enumerates local files and environment variables
• Collects credentials, tokens, and configuration files
• Compresses and encrypts the data
• Exfiltrates it using DNS TXT queries

Interestingly, the clean ESM version of the package remains unaffected, meaning only applications that require “node-ipc” are affected.

The malware targets a wide range of sensitive developer assets, including:

• Cloud credentials (AWS, Azure, GCP, OCI)
• SSH keys and Git credentials
• Kubernetes and Docker configurations
• .env files and database configs
• Terraform and CI/CD secrets

It also collects system-level artifacts such as /etc/hosts and full environment variable dumps, which may contain API keys, tokens, and authentication secrets.

To evade detection, collected files are renamed, compressed into a .tar.gz archive, and temporarily stored before exfiltration. If execution is interrupted, these archives may remain on disk, providing a key forensic artifact for responders.

Instead of using standard HTTP channels, the malware uses DNS TXT queries for data exfiltration. It communicates with a spoofed domain designed to resemble legitimate Azure infrastructure:

• sh[.]azurestaticprovider[.]net (bootstrap resolver)
• bt[.]node[.]js (exfiltration domain)

The payload splits encoded data into thousands of small DNS queries, making detection difficult without deep network inspection. A single infection can generate tens of thousands of DNS requests.

Maintainer Account Compromise

Early investigation suggests the attack may have originated from a compromised npm maintainer account. Researchers believe an attacker took control of a dormant account (atiertant) by exploiting an expired email domain, allowing them to reset credentials and publish malicious versions without breaching the npm infrastructure directly.

This technique highlights a growing risk in open-source ecosystems, abandoned or inactive maintainer accounts becoming entry points for attackers.

node-ipc was previously involved in a controversial 2022 incident involving destructive, geo-targeted malware. The reappearance of malicious code in this package suggests either repeated compromise or deliberate reintroduction, rather than a simple copycat attack.

Developers are strongly advised to immediately remove the affected versions and audit dependencies for transitive inclusion. Any system that loaded the CommonJS version should be treated as compromised.

Security teams should monitor DNS logs for unusual TXT query bursts and block known malicious domains. Rotating credentials, including cloud keys, SSH keys, and API tokens, is critical to prevent further compromise.

This incident reinforces a hard truth: even trusted open-source packages can become attack vectors overnight, and proactive dependency monitoring is no longer optional.

Indicators of Compromise (IOCs)

• Malicious package versions:
  • node-ipc@9.1.6
  • node-ipc@9.2.3
  • node-ipc@12.0.1
• Suspicious domains:
  • sh[.]azurestaticprovider[.]net
  • bt[.]node[.]js
• DNS query patterns:
  • xh., xd., xf.* subdomains
• Temporary file path:
  • /tmp/nt-<pid>/<machineHex>.tar.gz
• Artifact indicator:
  • Files timestamped Oct 26, 1985

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.