Popular node-ipc npm package compromised to steal credentials

Node‑ipc, a widely used Node.js IPC package, was found to contain credential‑stealing malware in three newly released versions: 9.1.6, 9.2.3, and 12.0.1. The malicious code is hidden inside the CommonJS entrypoint node‑ipc.cjs and executes automatically whenever an application loads, collecting environment variables, local files, and a wide range of credentials. Exfiltration is performed via DNS TXT queries to a fake Azure‑themed domain (sh.azurestaticprovider.net:443), with a 500 KB compressed archive generating roughly 29,400 TXT requests to blend in with normal traffic. Stolen data includes cloud credentials (AWS, Azure, GCP, OCI, DigitalOcean), SSH keys, Kubernetes/Docker/Helm/Terraform creds, npm/GitHub/GitLab tokens, .env files, database credentials, shell histories, CI/CD secrets, macOS Keychain, Linux keyrings, Firefox profile data, and Microsoft Teams local storage. The malware skips files larger than 4 MiB and ignores .git and node_modules directories to reduce noise, and it deletes temporary archives after exfiltration, leaving no persistence or secondary payloads. The attack was carried out by compromising the maintainer account “atiertant,” and affected developers are urged to immediately remove the compromised versions, rotate exposed secrets, and audit lockfiles and npm caches.