Socket: node-ipc npm Package Compromised

What it is

Malicious releases of the npm package node-ipc — versions 9.1.6, 9.2.3, and 12.0.1 — carrying an obfuscated stealer/backdoor. Socket also flagged historical malicious versions from the 2022 incident: 10.1.1 and 10.1.2 (geo-targeted destructive malware checking for Russia/Belarus before recursively overwriting files) and 11.0.0 and 11.1.0 (peacenotwar file-writing). All seven are classified malicious and recommended for blocking. The list of packages is tracked at https://socket.dev/supply-chain-attacks/node-ipc.

How it works

The payload lives only in node-ipc.cjs, appended as a single obfuscated IIFE. The ESM entrypoint node-ipc.js imports clean local source and has no payload — so consumers resolving via require("node-ipc") are exposed while import consumers may not be. There is no postinstall script; execution happens at runtime when the CJS bundle loads, triggered automatically via setImmediate().

On load the runner forks a detached child with env __ntw=1 (deleting NODE_OPTIONS, stdio: "ignore", windowsHide: true); the child runs collectAndExfiltrate(). If the fork fails, collection runs in the current process. The runner is also exported as __ntRun — any downstream code calling require("node-ipc").__ntRun() can re-trigger collection/exfiltration outside the original load event (e.g. from tests, build scripts, or packages that enumerate exports). A hash gate computed from the module basename changes whether module.exports is fully replaced by the runner.

Preconditions / Affected

CommonJS consumers of the affected versions. The intrusion vector: the dormant maintainer account atiertant had publish rights but hadn't shipped in years; its npm recovery email was reportedly on the expired domain atlantis-software[.]net, letting a new domain owner trigger a standard password reset and gain publish rights without touching any maintainer infrastructure (attribution: Ian Ahl / @TekDefense).

What to do

• Avoid installing and block versions 9.1.6, 9.2.3, 12.0.1 (plus historical 10.1.1, 10.1.2, 11.0.0, 11.1.0).
• Audit recent installs of node-ipc, prioritizing the three new versions.
• Package-level IOC: every file in the reviewed tarballs is timestamped Oct 26 1985. Use this when investigating cached tarballs or registry mirrors.

Caveats

This is a developing story; Socket was still confirming the full scope and extracting IOCs at publication. The maintainer-compromise vector ("assuming the recovery email was hosted on atlantis-software[.]net") is stated as a likely, not confirmed, chain. Socket's AI scanner detected the versions within ~3 minutes of publication.