thehackernews.com via Reddit

node-ipc npm package ships credential-stealing backdoor

cybersecurity open source cybersecurity supply-chain npm

Key insights

  • Three specific node-ipc versions (9.1.6, 9.2.3, 12.0.1) contained a 2.3 MB obfuscated payload that steals cloud, SSH, and CI/CD credentials.
  • The backdoor self-destructs after exfiltration, potentially destroying forensic evidence before affected teams can scope the breach.
  • This campaign is distinct from TanStack and Mini Shai-Hulud attacks but part of the same sustained npm supply-chain compromise wave.

Why this matters

Any organization running Node.js CI/CD pipelines that resolved these node-ipc versions may have handed attackers long-lived cloud IAM credentials and SSH keys, the kind of access that enables lateral movement into production infrastructure without triggering the original compromise vector again. The self-destruct behavior raises the bar for incident response significantly, since standard log-based forensics may show nothing after the payload fires, forcing teams to treat exposure as confirmed rather than suspected. At a structural level, this attack demonstrates that the npm ecosystem's trust model, where a package maintainer's account compromise is sufficient to weaponize millions of downstream installs, remains unresolved despite years of documented incidents.

Summary

Three versions of node-ipc, one of npm's more widely depended-upon inter-process communication packages, were found carrying a 2.3 MB obfuscated payload designed to silently exfiltrate cloud credentials, SSH keys, and CI/CD secrets before destroying itself to cover its tracks. The affected versions, 9.1.6, 9.2.3, and 12.0.1, embedded the stealer as a backdoor rather than a transitive dependency trick, meaning any project that pinned or resolved to these releases during their window of availability was exposed. The payload targets the exact secrets that give attackers persistent access well beyond the initial compromise: AWS and GCP keys, private SSH identity files, and the tokens CI pipelines use to deploy production infrastructure. Essentially: (node-ipc maintainers, npm registry) are at the center of a supply-chain attack that extends a documented pattern of ecosystem-level compromises, separate from but concurrent with the TanStack and Mini Shai-Hulud campaigns. - Versions 9.1.6, 9.2.3, and 12.0.1 are confirmed malicious; any dependency tree that resolved to these should be treated as fully compromised. - The self-destruct mechanism means forensic evidence may already be gone on affected systems, making incident scope harder to bound. - Immediate required actions: rotate all cloud IAM credentials, SSH keys, and CI/CD tokens on any system that ran the affected versions. This attack lands during a sustained wave of npm ecosystem compromises, and the credential-targeting pattern suggests the goal is persistent infrastructure access, not just a one-time data grab.

Potential risks and opportunities

Risks

  • Organizations with automated dependency update tooling (Dependabot, Renovate) that pulled any of the three versions into production pipelines may have already rotated into a compromised state without human review flagging it.
  • Exfiltrated AWS and GCP keys could be used to provision infrastructure for further attacks or cryptomining within days of exfiltration, incurring unexpected cloud bills and potential data-plane breaches before credential rotation completes.
  • CI/CD token theft specifically enables attackers to impersonate legitimate deployment pipelines, meaning malicious code could be pushed to production repositories at affected organizations with no obvious external entry point visible in audit logs.

Opportunities

  • Software composition analysis vendors (Snyk, Socket.dev, Chainguard) can demonstrate real-time malicious-package detection value to enterprise security buyers who are now actively evaluating npm registry monitoring gaps.
  • Secrets management and rotation platforms (HashiCorp Vault, Doppler, AWS Secrets Manager) gain a concrete incident narrative to accelerate deals with DevOps teams that currently store CI/CD tokens in environment variables or flat config files.
  • npm registry governance reform advocates and SLSA framework proponents have a fresh, high-profile case to push for mandatory publisher attestation and reproducible build requirements on widely-depended-upon packages.

What we don't know yet

  • Which specific npm account or maintainer credential was compromised to publish the malicious versions, and whether the access was via phishing, token theft, or a hijacked CI pipeline publishing automation.
  • How long the malicious versions were available on the npm registry before detection, and whether download counts for the affected versions have been disclosed.
  • Whether the exfiltrated credentials have been observed in active use against downstream victims' cloud infrastructure as of mid-May 2026.

Originally reported by thehackernews.com

Read the original article →

Original headline: Stealer Backdoor Found in 3 Node-IPC npm Versions — Obfuscated Payload Targets Developer Cloud Keys, SSH Keys, and CI/CD Secrets