Malicious node-ipc npm Versions Steal Developer Credentials via DNS
Summary
Researchers identified malicious node-ipc versions 9.1.6, 9.2.3 and 12.0.1 that reportedly steal developer and cloud credentials and exfiltrate archives through DNS TXT queries after a maintainer account was compromised.
Key points
- Versions 9.1.6, 9.2.3 and 12.0.1 contain malicious code that runs automatically through the node-ipc.cjs CommonJS entrypoint.
- The malware fingerprints systems and collects cloud, developer, infrastructure, database and other credentials, along with sensitive files and secrets.
- It compresses stolen data and exfiltrates it through DNS TXT queries, using sh[.]azurestaticprovider[.]net as a bootstrap resolver and sending data to bt[.]node[.]js.
- Socket estimated that exfiltrating a 500 KB compressed archive could generate about 29,400 DNS TXT requests.
- The malware skips files larger than 4 MiB and avoids .git and node_modules directories; it does not establish persistence or download secondary payloads.
- The compromise appears to involve an external actor taking over the inactive maintainer account “atiertant.”
- Developers should remove the affected versions, rotate exposed credentials and secrets, and inspect lockfiles and npm caches.
Article Details
- Attack Vectors
- A supply-chain attack introduced credential-stealing malware in node-ipc versions 9.1.6, 9.2.3, and 12.0.1 on npm.
- The malware executes automatically when applications load the package's CommonJS entrypoint, node-ipc.cjs.
- The malware collects cloud, developer, SSH, Kubernetes, Docker, database, and other credentials and sensitive local files, then exfiltrates compressed data through DNS TXT queries.
- Defensive Notes
- Remove node-ipc versions 9.1.6, 9.2.3, and 12.0.1.
- Rotate potentially exposed secrets and credentials.
- Inspect lockfiles and npm caches for affected versions.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sh[.]azurestaticprovider[.]net | Fake Azure-themed domain used as a bootstrap resolver in the malware's DNS exfiltration operation. |
MITRE ATT&CK
T1005 · Data from Local SystemThe malware collects environment variables and sensitive files from infected systems.T1027 · Obfuscated Files or InformationThe article describes the malicious code as heavily obfuscated.T1048.003 · Exfiltration Over Unencrypted Non-C2 ProtocolThe malware exfiltrates compressed stolen data using DNS TXT queries rather than conventional HTTP-based C2 traffic.T1059.007 · JavaScriptThe malware runs as JavaScript through the node-ipc.cjs CommonJS entrypoint when applications load the package.T1082 · System Information DiscoveryThe malware fingerprints infected systems.T1083 · File and Directory DiscoveryThe malware scans sensitive local files and avoids scanning .git and node_modules directories.T1195.002 · Compromise Software Supply ChainMalicious code was injected into published node-ipc package versions distributed through npm.T1552.001 · Credentials In FilesThe malware collects credentials from .env files and other sensitive local files.T1552.003 · Shell HistoryThe malware collects shell histories from infected systems.T1552.004 · Private KeysThe malware collects SSH keys and SSH configurations.T1555.001 · KeychainThe malware collects macOS Keychain files.T1555.003 · Credentials from Web BrowsersThe malware collects Firefox profile and key database files on macOS.T1560.001 · Archive via UtilityThe malware compresses collected data into tar.gz archives before exfiltration.
Products
node-ipcA supply-chain attack has injected credential-stealing malware into malicious node-ipc versions on npm, affecting a package that is downloaded more than 690,000 times each week.npmA supply-chain attack has injected credential-stealing malware into malicious node-ipc versions on npm, affecting a package that is downloaded more than 690,000 times each week.