Hackers have compromised three versions of the popular node-ipc npm package (9.1.6, 9.2.3, and 12.0.1) by taking over an inactive maintainer account. The injected malware hides in the CommonJS entrypoint, auto-executes on load, and collects a wide range of sensitive data including cloud credentials (AWS, Azure, GCP), SSH keys, Kubernetes/Docker/Terraform configs, CI/CD secrets, npm/GitHub tokens, and .env files. Stolen data is compressed and exfiltrated via DNS TXT queries to evade detection, using a fake Azure-themed domain. The malware leaves no persistence and deletes temporary archives after exfiltration. Affected developers should immediately remove the malicious versions, rotate all exposed credentials, and audit lockfiles and npm caches.
