Stealer Backdoor Found in 3 Node-IPC Versions Targeting Developer Secrets

This article describes malicious backdoor malware found in three npm package node-ipc versions (9.1.6, 9.2.3, 12.0.1).

• •Steals 90+ categories of developer credentials including AWS, Azure, SSH keys, and GitHub configs
• •Exfiltrates data via HTTPS POST and DNS TXT records using Google Public DNS
• •Payload injected as IIFE code into node-ipc.cjs instead of npm lifecycle hooks
• •Version 12.0.1 contains SHA-256 fingerprint check targeting specific projects
• •Account "atiertant" published the malicious versions after 21-month gap

This summary was automatically generated by AI based on the original article and may not be fully accurate.