StepSecurity Details Malicious node-ipc Releases Targeting Developer Credentials

Summary

StepSecurity reports that node-ipc versions 9.1.6, 9.2.3 and 12.0.1 published May 14, 2026, contain an obfuscated CommonJS payload that harvests developer credentials and exfiltrates them over HTTPS and DNS.

Key points

StepSecurity reports that account atiertant published node-ipc versions 9.1.6, 9.2.3 and 12.0.1 on May 14, 2026, with the same obfuscated payload in each.
The payload runs when the CommonJS bundle is loaded; the article says there are no lifecycle hooks and the ESM bundle is untouched.
The 12.0.1 payload has a hash-based module-path targeting check; the article says the 9.x payload lacks this gate.
The payload searches more than 90 categories of files and environment data for credentials and other secrets, then archives collected data.
Reported exfiltration methods include HTTPS and DNS TXT queries sent directly to the C2 IP; the C2 domain is sh[.]azurestaticprovider[.]net.
The article identifies 9.2.1 and 12.0.0 as last known-clean releases and advises affected users to rotate accessible secrets and investigate relevant systems and network logs.

Article Details

Attack Vectors: The malicious versions were published to npm under the maintainer account atiertant, which had no prior publish history for node-ipc. The article says it is unclear whether the account was compromised or added to enable the operation.
An obfuscated IIFE was appended to node-ipc.cjs and executes when the CommonJS package is loaded with require('node-ipc'); the package has no install-time lifecycle hooks, and its ESM entry point is untouched.
Versions 9.1.6 and 9.2.3 reportedly run the payload without a targeting gate; version 12.0.1 checks a SHA-256 hash of the module path before proceeding.
The payload spawns a detached process, enumerates the system and environment, and reads files matching patterns for credentials, keys, tokens, configuration, and shell history.
Collected data is assembled into a TAR archive, gzip-compressed, and exfiltrated through HTTPS POSTs and DNS TXT queries sent directly to the attacker’s server.
Defensive Notes: Treat systems that loaded [email protected], [email protected], or [email protected] as compromised; rotate credentials and secrets accessible in those environments.
Pin to a known-clean release and regenerate lockfiles; the article recommends [email protected] for 9.x users and [email protected] for 12.x users.
Check dependency trees and lockfiles for the three affected versions, including transitive dependencies and CI/CD installations after 2026-05-14.
Investigate connections to sh.azurestaticprovider[.]net and 37.16.75.69, including outbound UDP/53 traffic; the article also recommends reviewing cloud audit logs and workflow activity.
Check for $TMPDIR/nt-* staging directories and processes with the __ntw=1 environment marker; preserve relevant evidence for forensics.
Use egress allowlists and DNS egress controls to block unexpected destinations, including direct DNS traffic to 37.16.75.69.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`sh[.]azurestaticprovider[.]net`	Attacker-controlled C2 domain used for HTTPS exfiltration and resolution of the C2 server.
IPV4	`37[.]16[.]75[.]69`	C2 server IP used for HTTPS exfiltration and as the direct DNS TXT exfiltration sink.
MD5	`9672e9fb93a457f1d359511b4e53490d`	MD5 hash of the injected obfuscated IIFE block in the compromised package.
SHA1	`58ae7338960ef525d7c655023d7c81e3ddb283d6`	SHA-1 hash of the malicious [email protected] npm tarball.
SHA1	`ab7388363936bf527afd4173b5728c7cdbdd01ab`	SHA-1 hash of the compromised node-ipc.cjs payload file, identical across the three affected versions.
SHA1	`f5974a9774a22a863728b960543f68e7009099ef`	SHA-1 hash of the malicious [email protected] npm tarball.
SHA1	`fe5d107b9d285327af579259a32977c4f475fa26`	SHA-1 hash of the malicious [email protected] npm tarball.
SHA256	`449e4265979b5fdb2d3446c021af437e815debd66de7da2fe54f1ad93cbcc75e`	SHA-256 hash of the malicious [email protected] npm tarball.
SHA256	`78a82d93b4f580835f5823b85a3d9ee1f03a15ee6f0e01b4eac86252a7002981`	SHA-256 hash of the malicious [email protected] npm tarball.
SHA256	`96097e0612d9575cb133021017fb1a5c68a03b60f9f3d24ebdc0e628d9034144`	SHA-256 hash of the compromised node-ipc.cjs payload file, identical across the three affected versions.
SHA256	`b2001dc4e13d0244f96e70258346700109907b90e1d0b09522778829dcd5e4cf`	SHA-256 hash of the injected obfuscated IIFE block in the compromised package.
SHA256	`c2f4dc64aec4631540a568e88932b61daebbfb7e8281b812fa01b7215f9be9ea`	SHA-256 hash of the malicious [email protected] npm tarball.