Malicious Node-IPC Versions Compromise Developer Credentials
- Slowmist identified three malicious node-ipc versions on May 14, affecting over 822,000 weekly npm downloads.
- The malware payload of these versions steals over 90 categories of credentials, including AWS keys and .env files, using DNS tunneling.
- Developers are urged to pin to clean node-ipc versions and rotate exposed secrets immediately.
- The attack exploited a dormant maintainer account by re-registering an expired email domain to gain publish access.
- Security teams recommend auditing lock files for compromised versions (9.1.6, 9.2.3, or12.0.1) and rolling back to verified clean releases.
These malicious node-ipc versions pose a significant threat due to their widespread use in decentralized application build pipelines and developer tooling across the crypto ecosystem.
With over 822,000 weekly downloads, the attack surface is substantial, necessitating immediate action from developers to secure their projects against potential data breaches involving sensitive credentials like AWS keys and private keys stored in .env files.(Source)
