The compromise of the popular node-ipc npm package is another serious reminder that software supply-chain attacks are now directly targeting developer workstations and CI/CD environments. The affected versions, including node-ipc 9.1.6, 9.2.3, and 12.0.1, reportedly contained an obfuscated credential-stealing payload designed to collect sensitive files such as SSH keys, cloud credentials, Kubernetes configs, .env files, package manager tokens, and other developer secrets.
This incident is especially concerning because the malicious code was not limited to a typical install script. Researchers found that the payload could execute when the package was loaded through the CommonJS entry point, making it harder for teams to rely only on lifecycle-script blocking as protection. Organizations should immediately check dependency trees and lockfiles, remove affected versions, rotate exposed credentials, review CI/CD logs, and enforce dependency pinning, package allowlisting, maintainer MFA, and automated package scanning. Trusting public packages blindly is no longer software development; it is dependency roulette with production credentials on the table.

Hackers have injected credential-stealing malware into newly published versions of node-ipc, a popular inter-process communication package, in a new supply chain attack targeting npm. [...]

Source: Popular node-ipc npm package compromised to steal credentials via Bleeping Computer — published 15 May 2026.