node-ipc

Reported Context (4)

A supply-chain attack has injected credential-stealing malware into malicious node-ipc versions on npm, affecting a package that is downloaded more than 690,000 times each week. Malicious node-ipc npm Versions Steal Developer Credentials via DNS
Researchers found malicious code in node-ipc versions 9.1.6, 9.2.3, and 12.0.1 that steals developer and cloud credentials, fingerprints the host, and exfiltrates data to a command-and-control domain. Researchers Detail Malicious node-ipc Versions That Steal Developer Secrets
Socket’s threat feed has detected malicious activity in newly published versions of node-ipc, a long-running npm package previously associated with one of the most widely discussed supply chain incidents in the Malicious node-ipc npm Versions Steal Developer Credentials via DNS
On May 14, 2026, three node-ipc releases were published to npm with a backdoored CommonJS entrypoint. Backdoored node-ipc npm Releases Target Developer Credentials Through DNS Exfiltration

People (3)

MITRE ATT&CK (19)

Vendors (1)

Products (11)

Tools (1)

Industries (1)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.