## Overview

On 2026-05-14 between 14:25 and 14:26 UTC, three new versions of the popular node-ipc npm package — 9.1.6, 9.2.3, and 12.0.1 — were published containing a credential-stealing backdoor. node-ipc has approximately 822,000 weekly downloads and is a transitive dependency of widely deployed tooling including the Vue CLI, making this one of the highest-impact npm supply chain incidents of 2026 to date. The malicious releases were withdrawn within hours, but any CI/CD pipeline, developer workstation, or production build that resolved to one of the affected versions during the publication window must be considered compromised until cleared by credential rotation.

## Attack Vector

Independent analyses by Datadog Security Labs, Socket, SafeDep and StepSecurity converge on dormant-maintainer account takeover as the most plausible initial vector. The package was published from the 'atiertant' npm account, which had been inactive for years. The recovery email associated with the account used the domain atlantis-software.net, which had expired and become available for re-registration. By acquiring the expired domain, the adversary was able to receive npm password-reset email and seize control of the publish credentials without bypassing 2FA on a live mailbox. This pattern matches a class of npm supply-chain incidents documented since 2022 against unmaintained but still-widely-depended-on packages.

## Payload Activation

Unlike the more common 'preinstall' / 'postinstall' lifecycle script abuse pattern, the node-ipc payload does not run at install time. Instead, the malicious code is embedded in the CommonJS entrypoint shipped as node-ipc.cjs (SHA-256 96097e0612d9575cb133021017fb1a5c68a03b60f9f3d24ebdc0e628d9034144). It executes the first time any code calls require('node-ipc') in the consuming Node.js process. This significantly reduces detectability: package managers' install-time security scanners that focus on lifecycle script execution will see nothing, and the malicious behaviour only manifests inside the application runtime. A hash gate inside the payload decides at load time whether to fully replace module.exports with a benign-looking shim or to augment exports with a function named __ntRun, presumably to defeat detection in test environments.

## Execution and Process Behaviour

Once activated, the loader uses setImmediate to schedule the malicious work outside the synchronous import path, then forks a detached Node.js child process with stdio set to 'ignore'. The child sets the environment variable __ntw=1 to mark itself, drops into a per-invocation working directory of the form <tmpdir>/nt-<pid>/, and proceeds with host fingerprinting and credential harvesting. Detaching the child prevents the parent application from blocking on the malicious work and allows the stealer to outlive short-lived processes such as test runners or build steps. A tarball timestamp anomaly — the embedded mtime resolves to 'Oct 26 1985' (the Back to the Future date) — is used as a self-marker by the actor and is a high-fidelity indicator for forensic triage.

## Credential Harvesting Targets

The stealer enumerates the home directory and project directory for a wide set of high-value secret stores: AWS credentials (~/.aws/credentials), Azure access tokens (~/.azure/accessTokens.json), Google Cloud application default credentials (~/.config/gcloud/application_default_credentials.json), Oracle Cloud configuration (~/.oci/config), npm authentication tokens (.npmrc and ~/.npmrc), git credentials (~/.git-credentials and embedded credentials in .git/config), GitHub CLI hosts (~/.config/gh/hosts.yml), SSH private keys (~/.ssh/id_rsa, ~/.ssh/id_ed25519), Kubernetes kubeconfig (~/.kube/config), in-cluster service account tokens (/var/run/secrets/kubernetes.io/serviceaccount/token), generic .env and .env.production files, Rails-style database configuration (config/database.yml), Terraform variable files (terraform.tfvars), WordPress configuration (wp-config.php), the macOS Keychain database, Firefox key databases, Linux GNOME keyrings and KWallet files, and Microsoft Teams LevelDB stores. The selection is consistent with an adversary monetising stolen secrets across cloud takeover, source-code theft, npm package republishing, and Teams session hijack scenarios.

## Collection and Encoding

Harvested files are written into the per-invocation working directory and packed into a gzipped tar archive named <machineHex>.tar.gz where machineHex is a hex-encoded host fingerprint. The archive is then wrapped in a custom envelope: a SHA-256-derived keystream (seeded from the embedded key 'qZ8pL3vNxR9wKmTyHbVcFgDsJaEoUi') is XORed against the gzipped data, and a truncated 12-hex-character HMAC-SHA256 signature is appended for integrity. The result is hex-encoded for transport. A custom 16-character alphabet '0123456789GHJKMP' is used to fragment chunks into DNS-label-safe lengths.

## DNS Exfiltration Channel

Exfiltration uses DNS TXT queries to sh.azurestaticprovider.net under the suffix bt.node.js. Header records use the prefix xh. and carry up to 63 characters of metadata (machine ID, chunk count, payload size). Data records use the prefixes xd. and xf. and carry 31 characters per chunk before hex encoding doubles their length. Queries are batched up to 160 at a time using Promise.all with an 8000 ms timeout. Choosing DNS as the channel routes around most outbound HTTPS proxies, gives the adversary stealth against firewall log review (DNS volume to one apex domain is rarely investigated), and resolves through whatever recursive resolver the host is configured to use. The lookalike apex domain — sh.azurestaticprovider.net versus the legitimate Azure Static Web Apps domain azurestaticapps.net — is engineered to be missed in eyeball reviews of DNS logs. The authoritative IP at the time of analysis is 37.16.75.69.

## Defensive Posture

Any Node.js host that resolved to node-ipc 9.1.6, 9.2.3, or 12.0.1 between 14:25 UTC on 2026-05-14 and the takedown of the malicious tarballs must be treated as compromised. Required actions: (1) audit npm lockfiles, CI artifact caches, and container base images for the affected versions and SHA-256 hashes; (2) rotate every credential listed under credential targets that was reachable from the affected hosts (AWS access keys, Azure tokens, GCP credentials, GitHub PATs, npm tokens, SSH keys, Kubernetes kubeconfig contexts, Terraform variables, .env values); (3) sinkhole or block resolution of sh.azurestaticprovider.net and the IP 37.16.75.69 at the resolver and egress firewall; (4) hunt historical DNS logs for any TXT queries matching the patterns xh.<...>.bt.node.js, xd.<...>.bt.node.js, and xf.<...>.bt.node.js; (5) rebuild any container images or VM templates produced from a poisoned build; (6) review npm registry audit logs for unexpected publishes from accounts in the same dormant-maintainer cohort.