Popular node-ipc npm Package Infected with Credential Stealer

A supply chain attack has compromised the node-ipc npm package, with malicious versions 9.1.6, 9.2.3, and 12.0.1 containing obfuscated stealer and backdoor functionality. The attack vector involved takeover of a dormant maintainer account through an expired email domain. The malware fingerprints host environments, enumerates and reads local files including SSH keys, cloud credentials, database configurations, and various developer secrets. Collected data is compressed into a gzip archive and exfiltrated via DNS TXT queries to attacker-controlled infrastructure disguised as legitimate Azure domains. The payload targets over 100 file patterns across macOS and Linux systems, focusing on developer credentials from AWS, Azure, GCP, Kubernetes, Docker, npm, GitHub, and numerous other services. The malicious code executes during CommonJS module loading, forking a detached child process to perform credential harvesting while avoiding detection through obfuscation and DNS-based covert channels.

• Here We Go Again · JavaScript Payload AnalysisMalware2026-08-06
• Polymarket Breach Alert: Wallet-Draining Code Found in a Third-Party ScriptCampaign2026-10-30
• Inside Coruna and DarkSword Chains: From Web Lures to iOS ExploitationMalware2026-10-29
• Notorious Brazilian Magecart group hijacks Convertr checkouts via Plausible analyticsCampaign2026-10-27
• ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software VendorsMalware2026-10-22