Researchers have discovered three malicious versions of the widely used node-ipc npm package embedding a stealthy backdoor designed to harvest and exfiltrate sensitive developer secrets. This supply-chain compromise highlights risks to cloud identity, software build integrity, and operational trust.
- Malicious node-ipc updates harvest extensive developer and cloud credentials.
- Exfiltration uses encrypted payloads with HTTPS and stealthy DNS tunneling.
- Package compromise arose after 21-month inactivity with a new unauthorized maintainer.
Threat signal
Security researchers have flagged multiple suspicious versions of the node-ipc npm library, a widely integrated component used in various development and cloud automation workflows. These versions introduce a heavily obfuscated backdoor executed automatically whenever the package is required, without relying on typical npm installation hooks.
The malicious payload conducts targeted system fingerprinting and collects a diverse array of sensitive developer and cloud environment credentials, including tokens and configurations for major public cloud providers, container orchestration tools, developer IDEs, and database passwords. This breadth of data significantly increases the attack surface available for supply-chain and identity-focused threats.
Operator exposure
The infected node-ipc package versions were published by an account not connected to the original maintainer, following a 21-month hiatus since the last genuine release, suggesting a credential compromise or malicious maintainer insertion. This scenario underscores the critical challenge of managing trust and integrity in open source dependencies, especially those with high download volumes and broad usage in CI/CD pipelines.
From the operator perspective, the backdoor uses advanced evasion methods, including direct HTTPS posting to a command-and-control domain and DNS tunneling that bypasses local DNS monitoring by using popular public DNS resolvers. Consequently, traditional network defense tools focusing on corporate DNS logs may fail to detect this exfiltration, increasing risk exposure.
What teams should watch
Security, DevOps, and software supply-chain teams should prioritize auditing use of the vulnerable node-ipc versions in their codebases and pipelines. Immediate verification of package integrity and consideration of dependency lockdown or replacement is advised. Monitoring outbound network activity for anomalies, particularly DNS queries directed externally and uncharacteristic HTTPS connections, can aid detection.
Additionally, teams managing cloud identities and secrets must review potential credential leakage, especially for keys and tokens used in automated deployments or infrastructure provisioning. Raising awareness about risks from compromised open-source packages is essential to reinforce preemptive cybersecurity controls centered on supply-chain hygiene and identity governance.