This threat involves a supply chain compromise of the node-ipc npm package, where attacker-controlled versions 9.1.6, 9.2.3, and 12.0.1 contain obfuscated credential stealing and backdoor functionality. The attack vector was the takeover of a dormant maintainer account via an expired email domain. The malware fingerprints the host environment and enumerates local files, targeting developer secrets such as SSH keys, cloud service credentials (AWS, Azure, GCP), Kubernetes, Docker, npm, and GitHub credentials. It compresses the stolen data into gzip archives and exfiltrates it through DNS TXT queries to domains controlled by the attacker but disguised as legitimate Azure domains. Execution occurs during CommonJS module loading, with a detached child process performing the credential harvesting to avoid detection. Indicators include malicious domains and file hashes linked to the campaign. There is no vendor advisory or patch information available, and no known exploits in the wild have been reported.

The compromise allows attackers to steal a wide range of developer credentials and secrets from affected systems, potentially enabling unauthorized access to cloud services, source code repositories, and other critical infrastructure. This can lead to further compromise of development environments and cloud resources. The use of DNS-based exfiltration and obfuscation techniques increases the difficulty of detection and containment. However, no known active exploitation campaigns have been confirmed at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or update is available, users should avoid using the affected versions (9.1.6, 9.2.3, and 12.0.1) of the node-ipc package. Consider auditing existing environments for the presence of these versions and removing or replacing them. Monitor for suspicious DNS queries and network traffic to the identified malicious domains. Implement strict supply chain security practices, including verifying package integrity and maintaining control over maintainer accounts and email domains associated with package publishing.