Sophisticated Supply Chain Attack Targets Popular npm Package *node-ipc* A widely used npm package, node-ipc downloaded over 822,000 times weekly has been weaponized in a supply chain attack, exposing JavaScript developers to credential theft and backdoor access. Security researchers at Socket identified malicious versions (9.1.6, 9.2.3, and 12.0.1) of the package, which were published on May 14, 2026, shortly before detection. Unlike typical npm attacks, this campaign embedded malware directly into the package’s CommonJS entry point (node-ipc.cjs), executing automatically upon requiring the library. The ESM version remained unaffected, limiting exposure to applications using `require("node-ipc")`. The obfuscated malware conducts system fingerprinting, harvesting sensitive data including cloud credentials (AWS, Azure, GCP, OCI), SSH keys, Git tokens, Kubernetes/Docker configs, .env files, and CI/CD secrets before compressing and encrypting it into a `.tar.gz` archive at `/tmp/nt-<pid>/`. Exfiltration occurs via covert DNS TXT queries to attacker-controlled domains (sh.azurestaticprovider[.]net, bt.node[.]js), evading standard network monitoring by splitting data into small chunks. Investigators traced the attack to a hijacked npm maintainer account (atiertant), where an expired email domain allowed credential resets without breaching npm’s infrastructure. This tactic underscores a growing risk: dormant maintainer accounts as silent entry points for supply chain attacks. The incident follows node-ipc’s prior involvement in a 2022 geo-targeted malware campaign, raising concerns about repeated compromise or deliberate reintroduction. Security teams are advised to monitor DNS logs for unusual TXT query bursts and block listed domains. Indicators of Compromise (IOCs): - Malicious packages: [email protected], 9.2.3, 12.0.1 - Exfiltration domains: sh.azurestaticprovider[.]net, bt.node[.]js - DNS patterns: xh., xd., xf.* subdomains - Temp file path: `/tmp/nt-<pid>/<machineHex>.tar.gz` - Anomalous timestamp: October 26, 1985 (file artifacts)