---
title: "Popular node-ipc npm package compromised to steal credentials"
url: https://daily.dev/posts/popular-node-ipc-npm-package-compromised-to-steal-credentials-41k0opnku
source_url: https://www.bleepingcomputer.com/news/security/popular-node-ipc-npm-package-compromised-to-steal-credentials
type: article
source: "BleepingComputer"
published: 2026-05-15T17:13:14.641Z
updated: 2026-05-15T17:13:56.031Z
tags: ["security", "cyber", "npm"]
reading_time: 3
upvotes: 1
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Popular node-ipc npm package compromised to steal credentials

**[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 1 upvotes · 0 comments

## Summary

Hackers have compromised three versions of the popular node-ipc npm package (9.1.6, 9.2.3, and 12.0.1) by taking over an inactive maintainer account. The injected malware hides in the CommonJS entrypoint, auto-executes on load, and collects a wide range of sensitive data including cloud credentials (AWS, Azure, GCP), SSH keys, Kubernetes/Docker/Terraform configs, CI/CD secrets, npm/GitHub tokens, and .env files. Stolen data is compressed and exfiltrated via DNS TXT queries to evade detection, using a fake Azure-themed domain. The malware leaves no persistence and deletes temporary archives after exfiltration. Affected developers should immediately remove the malicious versions, rotate all exposed credentials, and audit lockfiles and npm caches.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.bleepingcomputer.com/news/security/popular-node-ipc-npm-package-compromised-to-steal-credentials>

## Similar posts on daily.dev

- [Malicious node-ipc Versions Published to npm](https://daily.dev/posts/malicious-node-ipc-versions-published-to-npm-f0fzlndjv) · Snyk · 2 upvotes · 0 comments
- [Expired domain leads to supply chain attack on node-ipc npm package](https://daily.dev/posts/expired-domain-leads-to-supply-chain-attack-on-node-ipc-npm-package-cek2g6opk) · CSO Online · 11 upvotes · 2 comments
- [Active Supply Chain Attack: Malicious node-ipc Versions Published to npm](https://daily.dev/posts/active-supply-chain-attack-malicious-node-ipc-versions-published-to-npm-zhegwtj50) · StepSecurity · 29 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#npm](https://daily.dev/tags/npm)

[View this post on daily.dev](https://daily.dev/posts/popular-node-ipc-npm-package-compromised-to-steal-credentials-41k0opnku)