{“lastseen”:”2026-05-14T17:30:07″,”description”:”\\n\\nCybersecurity researchers are sounding the alarm about what has been described as \\”malicious activity\\” in newly published versions of node-ipc.\\n\\nAccording to Socket and StepSecurity, three different versions of the npm package have been confirmed as malicious -\\n\\n * node-ipc@9.1.6\\n * node-ipc@9.2.3\\n * node-ipc@12.0.1\\n\\n\\n\\n\\”Early analysis indicates that node-ipc@9.1.6, node-ipc@9.2.3, and node-ipc@12.0.1 contain obfuscated stealer\/backdoor behavior,\\” Socket said.\\n\\n\\”The malware appears to fingerprint the host environment, enumerate and read local files, compress and chunk collected data, wrap the payload in a cryptographic envelope, and attempt exfiltration through a network endpoint selected via DNS\/address logic.\\”\\n\\nStepSecurity said the heavily obfuscated payload is triggered when the package is required at runtime, and attempts to exfiltrate a broad set of developer and cloud secrets to an external command-and-control server.\\n\\nThis is not the first time the npm package has incorporated malicious functionality. In March 2022, the maintainer of the package deliberately introduced destructive capability to versions 10.1.1 and 10.1.2 by overwriting files on systems located in Russia or Belarus as a form of protest following Russia’s military invasion of Ukraine.\\n\\nTwo subsequent versions \u2013 11.0.0 and 11.1.0 \u2013 included the \\”peacenotwar\\” dependency, which was also published by the same maintainer as a \\”non-violent protest against Russia’s aggression.\\”\\n\\n\\”The latest incident appears to involve a suspicious republishing or reintroduction of malicious code into versions of a known package, rather than a typosquatting attempt,\\” Socket said.\\n\\n_(This is a developing story. Please check back for more details.)_\\n\\nFound this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.\\n”,”published”:”2026-05-14T17:22:00″,”modified”:”2026-05-14T17:22:43″,”type”:”thn”,”title”:”Stealer Backdoor Found in 3 Node-IPC Versions Targeting Developer Secrets”,”source”:””,”references”:””,”id”:”THN:7E008AC2F41F8784721A7FC21B43DBC0″,”bulletinFamily”:”info”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/thehackernews.com\/2026\/05\/stealer-backdoor-found-in-3-node-ipc.html”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-14T17:30:07″,”description”:”\\n\\nCybersecurity researchers are sounding the alarm about what has been described as \\”malicious activity\\” in newly published versions of node-ipc.\\n\\nAccording to Socket and StepSecurity, three…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,13,33,7,11,43,5],"class_list":["post-54568","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-security","tag-tapic","tag-thn","tag-vulnerability"],"yoast_head":"\n