Backdoored node-ipc npm Releases Target Developer Credentials Through DNS Exfiltration
Summary
Three node-ipc releases published on May 14, 2026, contained a backdoor that runs when the CommonJS entrypoint is loaded, collects host and developer credentials, and attempts to exfiltrate them through DNS TXT queries.
Key points
- Affected npm releases are node-ipc 9.1.6, 9.2.3, and 12.0.1, published on May 14, 2026.
- The payload runs when the CommonJS entrypoint is loaded; it does not depend on an npm lifecycle script.
- It forks a detached child process, gathers host details and credentials from developer, cloud, source-control, Kubernetes, SSH, and application files, and packages them in a compressed archive.
- The malware attempts to exfiltrate archive data through DNS TXT queries under bt.node.js, using sh.azurestaticprovider.net on port 443 as its resolver endpoint.
- Indicators include the affected package versions, the node-ipc.cjs file hash, sh.azurestaticprovider.net, and query names under bt.node.js.
- The article recommends identifying affected dependencies and runtime-loaded instances, blocking the DNS infrastructure, preserving telemetry, and rotating credentials that may have been exposed.
- Consumers should review package releases and runtime behavior; maintainers should use trusted publishing, MFA, restricted tokens, and review generated release artifacts.
Article Details
- Attack Vectors
- Backdoored node-ipc releases 9.1.6, 9.2.3, and 12.0.1 execute the payload when the CommonJS entrypoint is loaded; execution does not depend on an npm lifecycle script.
- The payload forks a detached child process, collects host details and developer, cloud, package manager, source control, Kubernetes, database, and SSH credentials, then packages the data into a gzip-compressed tar archive.
- The malware exfiltrates archive data through DNS TXT queries using generated names under bt.node.js, with sh.azurestaticprovider.net configured as the DNS resolver endpoint on port 443.
- Defensive Notes
- Inventory package manifests and lock files for the affected node-ipc versions, and determine whether the CommonJS entrypoint was loaded at runtime.
- Inspect node_modules/node-ipc/node-ipc.cjs for the reported file hash, __ntRun marker, or encoded configuration strings.
- Monitor for detached Node.js child processes using __ntw=1, credential-file reads after package loading, temporary nt-<pid> directories containing *.tar.gz files, and TXT queries under bt.node.js.
- Sinkhole or block sh.azurestaticprovider.net, restrict direct DNS to unapproved resolvers such as 8.8.8.8 and 1.1.1.1, and block DNS-like traffic to 37.16.75.69:443.
- For hosts that installed and loaded an affected version, preserve host and CI telemetry, remove the package, rotate potentially exposed credentials, and review package publishing tokens, GitHub tokens, SSH keys, cloud credentials, Kubernetes credentials, and CI secrets.
- Pin known-good dependency versions, review newly published releases, and monitor both install-time and runtime package behavior.
- Maintainers should use trusted publishing and multifactor authentication, restrict long-lived publish tokens, monitor unexpected direct publishes, and review generated bundles as release artifacts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sh[.]azurestaticprovider[.]net | Malware-configured DNS resolver endpoint used for exfiltration. |
| IPV4 | 37[.]16[.]75[.]69 | Observed IP address of the malware's DNS resolver endpoint on May 14, 2026. |
| SHA256 | 449e4265979b5fdb2d3446c021af437e815debd66de7da2fe54f1ad93cbcc75e | SHA-256 hash of the malicious [email protected] tarball. |
| SHA256 | 78a82d93b4f580835f5823b85a3d9ee1f03a15ee6f0e01b4eac86252a7002981 | SHA-256 hash of the malicious [email protected] tarball. |
| SHA256 | 96097e0612d9575cb133021017fb1a5c68a03b60f9f3d24ebdc0e628d9034144 | SHA-256 hash of the backdoored node-ipc.cjs file. |
| SHA256 | c2f4dc64aec4631540a568e88932b61daebbfb7e8281b812fa01b7215f9be9ea | SHA-256 hash of the malicious [email protected] tarball. |
MITRE ATT&CK
T1005 · Data from Local SystemThe payload collects environment variables, host information, /etc/hosts, and local credential files.T1027 · Obfuscated Files or InformationThe article describes an obfuscated payload with encoded configuration and transformed data used for exfiltration.T1041 · Exfiltration Over C2 ChannelThe payload exfiltrates the collected archive through DNS TXT query names sent to its configured resolver endpoint.T1059.007 · JavaScriptThe malicious payload is JavaScript executed by Node.js when the package's CommonJS entrypoint is loaded.T1105 · Ingress Tool TransferNot supportedT1547.001 · Registry Run Keys / Startup FolderNot supported
Vendors
Products
GitHubThose exclusions still leave many project directories in scope, especially when secrets are stored in files such as .env, GitHub workflow files, Terraform variable files, and application configuration.node-ipcOn May 14, 2026, three node-ipc releases were published to npm with a backdoored CommonJS entrypoint.