node

Cybersecuritynews •Guru Baran • May 14, 2026

A widely used JavaScript inter-process communication library has been weaponized again. Socket and Stepsecurity have confirmed that three newly published versions of node-ipc, a package with over 822,000 weekly downloads, contain obfuscated stealer and backdoor payloads, marking the second major supply chain compromise of this package since 2022. The affected versions are [email protected], [email protected], and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Supply Chain Attack on node-ipc npm Package Exposes 822K Downloads to Credential Theft A supply chain attack on the node-ipc npm package has compromised three versions (9.1.6, 9.2.3, 12.0.1) with credential-stealing malware. The attack exploited an expired domain to hijack a dormant maintainer account, allowing attackers to publish malicious versions that contain an 80KB payload capable of stealing over 90 types of credentials. The malware uses DNS tunneling for data exfiltration, making detection difficult. This incident affects over 822,000 weekly downloads, posing a significant risk to developers utilizing the package in their projects. Security firms, including Socket and Slowmist, confirmed the malicious activity, which was active for about two hours before detection. Users are advised to audit their systems and rotate any exposed credentials immediately. 8 sources 72

node

The full story

Extracted Entities

Attack Types (1)

Platforms (1)