Malicious node-ipc npm Versions Steal Developer Credentials via DNS

May 14, 2026 · Original article ↗

Summary

Three malicious node-ipc versions execute a credential-stealing payload when loaded through CommonJS. The malware collects developer and CI secrets and exfiltrates them via DNS TXT queries; developers are urged to remove affected versions and rotate exposed credentials.

Key points

The confirmed malicious releases are node-ipc 9.1.6, 9.2.3, and 12.0.1; the payload is appended to the CommonJS entrypoint.
On module load, the payload can run in a detached child process and collect environment variables, configuration files, keys, and other developer or infrastructure secrets.
It archives collected data and attempts exfiltration through DNS TXT queries to bt[.]node[.]js, using sh[.]azurestaticprovider[.]net as a bootstrap resolver.
The reviewed ESM entrypoint does not contain the payload, but ESM users may still be exposed if another dependency or direct require loads the malicious CommonJS file.
Researchers suspect a dormant maintainer account was taken over through an expired email domain; attribution remains unconfirmed.
The analyzed payload showed no persistence or second-stage download behavior, and the incident's full scope is still under investigation.
Remove affected versions, audit recent installs and caches, treat exposed secrets as compromised, rotate credentials, and monitor for the listed file and DNS indicators.

Article Details

Attack Vectors: Malicious code was appended to node-ipc.cjs and executed when CommonJS consumers loaded the package; the reviewed ESM entrypoint did not contain the payload.
According to researcher Ian Ahl, a likely publication vector was takeover of a dormant maintainer account through an expired email domain; the article presents this as an assumption, not a confirmed attribution.
The payload collected host and environment information and targeted local developer and infrastructure credentials, configuration, and files.
The payload compressed collected data and attempted to exfiltrate it through DNS TXT queries to bt[.]node[.]js, using sh[.]azurestaticprovider[.]net as a bootstrap resolver.
Defensive Notes: Remove the affected node-ipc versions and reinstall from a known-clean version; audit dependency lockfiles, build caches, and npm caches.
Treat exposed environment variables and local developer secrets as compromised if the CommonJS entrypoint was loaded, and rotate affected credentials.
Monitor for DNS queries to sh[.]azurestaticprovider[.]net and TXT-query label prefixes xh, xd, or xf under bt[.]node[.]js, including high-volume query bursts.
Check for the malicious node-ipc.cjs hash and temporary archives matching <tmp>/nt-<pid>/<machineHex>.tar.gz; preserve matching temporary directories during live response.
Review whether applications load node-ipc through CommonJS, ESM, or a transitive dependency, and inspect package entrypoints as part of dependency review.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`bt[.]node[.]js`	DNS exfiltration zone receiving the payload's TXT queries.
DOMAIN	`sh[.]azurestaticprovider[.]net`	Bootstrap resolver used by the malicious payload before DNS TXT exfiltration.
IPV4	`37[.]16[.]75[.]69`	Reported resolved IP address of the malicious payload's bootstrap host at publication time.
SHA256	`449e4265979b5fdb2d3446c021af437e815debd66de7da2fe54f1ad93cbcc75e`	SHA-256 of the malicious node-ipc-9.1.6.tgz package artifact.
SHA256	`78a82d93b4f580835f5823b85a3d9ee1f03a15ee6f0e01b4eac86252a7002981`	SHA-256 of the malicious node-ipc-12.0.1.tar.gz package artifact.
SHA256	`96097e0612d9575cb133021017fb1a5c68a03b60f9f3d24ebdc0e628d9034144`	SHA-256 of the malicious node-ipc.cjs file.
SHA256	`c2f4dc64aec4631540a568e88932b61daebbfb7e8281b812fa01b7215f9be9ea`	SHA-256 of the malicious node-ipc-9.2.3.tgz package artifact.