Node‑ipc Found to Contain Malicious Activity in Multiple Versions
Remove node‑ipc from your dependencies and replace it with a vetted alternative; run a security audit.
Remove node‑ipc from your dependencies and replace it with a vetted alternative; run a security audit.
Summary
Security researchers have identified malicious activity in three versions of the node‑ipc npm package: node‑[email protected], node‑[email protected], and node‑[email protected]. The malicious code was confirmed by Socket and StepSecurity, indicating that these releases contain backdoors that can exfiltrate data or execute arbitrary commands. Early analysis shows that the malicious payload is triggered by specific API calls within the package. The affected versions have been flagged by the npm registry, and maintainers are working to remove the compromised code. Developers who rely on node‑ipc should immediately remove the vulnerable versions and replace them with a secure alternative. The incident underscores the importance of verifying package integrity and monitoring for suspicious behavior. The npm community is urged to adopt stricter vetting processes for high‑impact packages. Users are advised to update to the latest safe release once available.
Key changes
- node‑[email protected], @9.2.3, and @12.0.1 contain malicious code.
- The backdoors can exfiltrate data or execute arbitrary commands.
- The malicious payload is triggered by specific API calls.
- npm has flagged the versions and maintainers are removing them.
- Developers should remove the vulnerable versions and update to a safe release.