What's Happening
Three versions of the widely used npm package node-ipc (9.1.6, 9.2.3, and 12.0.1) were confirmed malicious this week by researchers at Socket and StepSecurity. The packages contain obfuscated stealer and backdoor code that fires on every require('node-ipc') call, enumerates the host environment, and exfiltrates credentials across 90 categories including AWS, GCP, Azure, SSH keys, Kubernetes tokens, GitHub CLI configs, Terraform state, database passwords, and shell history. Stolen data is compressed and sent to a fake Azure domain via HTTPS and through a DNS exfiltration channel that bypasses corporate DNS resolvers entirely by routing queries directly to the C2 IP.
The packages were published by an account named "atiertant" with no prior history on the package, 21 months after the last legitimate update. 12.0.1 includes a SHA-256 fingerprint check targeting a specific developer or project before executing, suggesting at least one version was a targeted attack rather than opportunistic. The 9.x versions have no such gate and will run the full payload on any system that loads them.
Why Should You Care
node-ipc is a transitive dependency for a large number of JavaScript projects, meaning it can be pulled in without you explicitly listing it. The credential scope here is unusually broad: 90 categories covering essentially every cloud provider, developer tool, and secret store a typical engineering environment would have. The DNS exfiltration technique is worth calling out specifically as it routes queries directly to the attacker's C2 server rather than through public resolvers, making this traffic invisible to any detection that relies solely on corporate DNS logging.
The fingerprinted 12.0.1 version also signals a level of targeting sophistication that goes beyond typical supply chain opportunism. Someone knew exactly which project or developer they were after and pre-computed the hash of their entry point before publishing.
What Should You Do
If node-ipc appears anywhere in your dependency tree, treat the affected machines as potentially compromised. Remove versions 9.1.6, 9.2.3, and 12.0.1 and pin to 9.2.1 or 12.0.0. Rotate all secrets that were present on any machine that loaded the package, audit cloud logs for unauthorized IAM activity during the exposure window, and review workflow run logs for suspicious behavior. Block egress traffic to sh.azurestaticprovider[.]net if you haven't already.