Malicious nodeipc versions on npm briefly exposed secrets via DNS exfiltration

Three malicious versions of a widely used Node.js package, nodeipc, were published to the npm registry on May 14, exposing developers and systems that installed or auto-updated the dependency during a brief window, cybersecurity researchers said. The compromised releases, identified as 9.1.6, 9.2.3 and 12.0.1, contained obfuscated code that executes automatically when the package is loaded and is designed to harvest sensitive credentials from a host machine and exfiltrate them.

Researchers traced the attack to an email takeover of a dormant maintainer account. The maintainers email domain, atlantissoftware.net, had expired on January 10, 2025. Investigators said an attacker re-registered the domain on May 7, 2026, gained control of the associated mailbox, and used npm’s password reset process to obtain publishing access. The malicious versions stayed live for roughly two hours before removal, according to the researchers.

nodeipc enables interprocess communication for Node.js applications across different socket types and is used both directly by developers and indirectly as a dependency for many other packages. Download estimates cited by researchers placed usage in the...