The malicious Node-IPC versions are another sharp reminder that open-source package repositories are now part of the enterprise attack surface. Three newly published node-ipc versions, reportedly 9.1.6, 9.2.3, and 12.0.1, were confirmed to contain obfuscated stealer and backdoor behavior targeting developer and cloud secrets. That is especially serious because developer machines and CI/CD environments often hold API keys, tokens, SSH keys, cloud credentials, and repository access.

Organizations should immediately check dependency trees for the affected versions, remove compromised packages, rotate any exposed credentials, review CI/CD logs, and enforce package pinning, lockfiles, private registries, MFA for maintainers, and automated malware scanning for dependencies. Supply-chain security cannot depend on trust alone, because attackers have clearly realized that poisoning one popular package is more efficient than attacking every company one by one. Very considerate of them, in the worst possible way.

Cybersecurity researchers are sounding the alarm about what has been described as "malicious activity" in newly published versions of node-ipc. According to Socket and StepSecurity, three different versions of the npm package have been confirmed as malicious - node-ipc@9.1.6 node-ipc@9.2.3 node-ipc@12.0.1 "Early analysis indicates that node-ipc@9.1.6, node-ipc@9.2.3, and node-ipc@12.0.1

Source: Stealer Backdoor Found in 3 Node-IPC Versions Targeting Developer Secrets via The Hacker News — published 14 May 2026.