Researchers Detail Malicious node-ipc Versions That Steal Developer Secrets

Article Details

Attack Vectors

• Malicious payloads were appended to node-ipc versions 9.1.6, 9.2.3, and 12.0.1 and execute when the package is required at runtime; the malware does not rely on npm lifecycle hooks.
• Version 12.0.1 checks a SHA-256 fingerprint of the primary module path and proceeds only when it matches a hard-coded target value. The article says the 9.x versions do not have this gate.
• The obfuscated payload fingerprints the host, enumerates and reads local files, and harvests developer and cloud credentials, including keys and configuration data.
• Stolen data is compressed into a GZIP archive and exfiltrated through an HTTPS POST and DNS TXT queries. The malware uses DNS/address logic to resolve its C2 and directs exfiltration queries to the C2 IP.
• The malware forks into detached background child processes to continue exfiltration after the parent Node.js process terminates.

Defensive Notes

• Remove compromised node-ipc versions 9.1.6, 9.2.3, and 12.0.1, and reinstall a known clean version; the article identifies 9.2.1 and 12.0.0.
• Assume affected systems may be compromised and rotate credentials and secrets accessible during the exposure window.
• Audit npm publishing activity for packages accessible with rotated tokens, review workflow run logs, and check cloud logs for unauthorized actions by affected IAM identities.
• Block egress traffic to the reported C2 domain.