node-ipc npm package backdoored via expired-domain account takeover — 90+ credential categories exfiltrated, three malicious versions, ~3-minute window to detection
On 2026-05-14, three malicious versions of the node-ipc npm package (versions 9.1.6, 9.2.3, and 12.0.1 — node-ipc is a widely-used Node.js IPC library, with CSO Online reporting approximately 700 K weekly downloads and inclusion as a transitive dependency in hundreds of projects including Vue CLI and various webpack tooling) were published simultaneously by the long-dormant maintainer account atiertant, whose registered email domain atlantis-software.net had expired in January 2025 and was re-registered by an attacker via Namecheap on 2026-05-07 (Socket Security, 2026-05-14 · StepSecurity, 2026-05-14 · The Hacker News, 2026-05-14 · CSO Online, 2026-05-14). The attacker used the recovered domain to receive an npm password-reset email and then published the backdoored versions. The malicious payload is an 80 KB obfuscated Immediately-Invoked Function Expression appended to node-ipc.cjs (the CommonJS bundle); it fires unconditionally on every require('node-ipc') via setImmediate(), and notably does not use an npm lifecycle hook (preinstall, postinstall), which lets it bypass npm audit and conventional install-time scanning that only inspects lifecycle-script execution. Four-layer obfuscation (string-array shuffling, control-flow flattening, dead-code injection, custom reversed-nibble base-16 encoding) defeats static signature analysis. The collector enumerates approximately 90 file-path patterns covering AWS / Azure / GCP / OCI / DigitalOcean / Hetzner / Fly / Vercel credentials and configs, SSH private keys, Kubernetes service-account tokens, GitHub CLI configurations, npm and Git tokens, Terraform state, .env files, shell history, and macOS Keychain databases; data is GZIP-compressed then exfiltrated over two simultaneous channels — DNS TXT queries to the bt.node.js suffix and HTTPS POST to sh.azurestaticprovider[.]net:443. Version 12.0.1 carries an additional SHA-256 fingerprint check targeting specific high-value projects; the 9.x versions fire universally. The ESM entry point is unaffected. Socket's AI scanner flagged the publish within ~3 minutes; the malicious versions were removed from the registry shortly thereafter. MITRE ATT&CK: T1195.002 Compromise Software Supply Chain, T1555 Credentials from Password Stores, T1048.003 Exfiltration Over Alternative Protocol (DNS), T1083 File and Directory Discovery. Defender action: enumerate node-ipc installs (npm ls node-ipc across the build graph, including transitive); on any workstation or CI runner that installed one of the three flagged versions between 2026-05-14 publish time and registry removal, treat every secret available in the environment (cloud SDK profiles, SSH keys, npm / Git tokens, Kubernetes contexts) as compromised and rotate. Enforce npm ci --ignore-scripts in CI, pin via lockfile, and monitor for outbound DNS queries to *.bt.node.js.
ATT&CK mapping
6 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1195Supply Chain Compromise
Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.
T1195.002Supply Chain Compromise: Compromise Software Supply Chain
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
Credential Access TA0006
T1555Credentials from Password Stores
Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.
Discovery TA0007
T1083File and Directory Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Exfiltration TA0010
T1048Exfiltration Over Alternative Protocol
Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
T1048.003Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.