NPM · MAY 2026 · CONFIRMED

node-ipc npm Package Compromised: What Happened

On May 14, 2026, three malicious versions of node-ipc, a foundational Node.js inter-process communication library with more than 10 million weekly downloads, were published to the npm registry in quick succession. Versions 9.1.6, 9.2.3, and 12.0.1 each carried an identical, heavily obfuscated payload of roughly 80 kilobytes designed to steal cloud credentials, SSH keys, and CI/CD secrets from any machine that installed them. This is a distinct, later compromise of the package and unrelated to the 2022 incident in which node-ipc's own maintainer added protest-driven code targeting Russian and Belarusian IP addresses; the two events share a package name but nothing else.

What happened

node-ipc's role as low-level plumbing for inter-process communication means it is frequently pulled in as a transitive dependency rather than something most engineering teams consciously track. Publishing three malicious versions across different version lines at once, rather than a single incremental release, suggests the attacker had broad publish access and wanted to maximize the chance that at least one compromised version would be picked up by an automatic dependency update.

The payload's target list, cloud provider credentials, SSH private keys, and CI/CD pipeline secrets, points toward an attacker interested in pivoting from a single compromised developer machine into an organization's broader infrastructure, rather than a narrowly scoped, single-target attack. Security researchers flagged the compromise and the identical payload across all three versions shortly after publication.

Packages affected

How 0Day mitigates this

TRANSITIVE DEPENDENCIES GET THE SAME COVERAGEA low-level utility library like node-ipc is exactly the kind of transitive dependency that rarely gets manually reviewed before an update lands. 0Day's matching runs against your organization's full dependency graph, including every transitive dependency, so a compromise several layers deep still reaches the engineers who own the affected repositories, not just the ones who explicitly chose the package.

Read how this differs from a scanner that only flags direct dependencies you explicitly track, or see the exact, read-only access 0Day needs to do this for an organization.

Sources

StepSecurity: Active Supply Chain Attack, Malicious node-ipc Versions Published to npm
Unit 42: The npm Threat Landscape, Attack Surface and Mitigations

Join the 0Day waitlist →

← Back to all incidents