Key Takeaways
Slowmist flagged three malicious node-ipc variations on Could 14, concentrating on over 822,000 weekly npm downloads.The 80KB payload steals 90+ credential classes, together with AWS keys and .env recordsdata by way of DNS tunneling.Builders should instantly pin to wash node-ipc variations and rotate all probably uncovered secrets and techniques.
Developer Secrets and techniques at Stake
Blockchain safety agency Slowmist flagged the assault by way of its Misteye risk intelligence system, figuring out three rogue releases, particularly variations 9.1.6, 9.2.3, and 12.0.1. The node-ipc bundle, used to allow inter-process communication (IPC) in Node.js environments, is embedded throughout decentralized software ( dApp) construct pipelines, CI/CD programs, and developer tooling all through the crypto ecosystem.
The bundle averages over 822,000 weekly downloads, making the assault floor substantial. Every of the three malicious variations carries an similar 80 KB obfuscated payload appended to the bundle’s CommonJS bundle. The code fires unconditionally on each require(‘node-ipc’) name, that means any venture that put in or up to date to the contaminated releases ran the stealer mechanically, with no consumer interplay wanted.
What the Malware Steals
The embedded payload targets over 90 classes of developer and cloud credentials, together with Amazon Internet Providers (AWS) tokens, Google Cloud and Microsoft Azure secrets and techniques, SSH keys, Kubernetes configurations, Github CLI tokens, and shell historical past recordsdata. Pertinent to the crypto area, the malware targets .env recordsdata, which incessantly retailer non-public keys, RPC node credentials, and trade API secrets and techniques. Stolen information is exfiltrated by way of DNS tunneling, routing recordsdata by Area Identify System queries to evade customary community monitoring instruments.
Researchers at Stepsecurity confirmed the attacker by no means touched node-ipc’s unique codebase. As a substitute, they exploited a dormant maintainer account by re-registering its expired electronic mail area.
The area atlantis-software.internet expired on January 10, 2025, with the attacker re-registering it by way of Namecheap on Could 7, 2026. They then triggered a regular npm password reset, gaining full publish entry with out the unique maintainer’s data.
The malicious variations remained dwell on the registry for about two hours earlier than detection and elimination. Any venture that ran npm set up or auto-updated dependencies throughout that window ought to be handled as probably compromised. Safety groups have really helpful auditing lock recordsdata instantly for variations 9.1.6, 9.2.3, or 12.0.1 of node-ipc and rolling again to the final verified clear launch.
Provide chain assaults on the npm ecosystem have turn out to be a persistent risk in 2026, with crypto initiatives serving as high-value targets as a result of direct monetary entry their credentials can present.
