Critical Malicious Code Injection in node-ipc Package
Summary
MAL-2026-3744: Malicious code in node-ipc (npm). Affects node-ipc versions 12.0.1 – 9.2.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-ipc is a popular Node.js package that facilitates inter-process communication (IPC) between Node.js applications. It allows developers to create applications that can communicate with each other seamlessly, making it a vital tool for building scalable and efficient applications. However, on May 14, 2026, three versions of node-ipc (9.1.6, 9.2.3, 12.0.1) were compromised, introducing a significant security vulnerability.
Vulnerability Detail
The vulnerability stems from a malicious payload embedded in the compromised versions of node-ipc. This payload, which is 80KB in size and obfuscated, is designed to steal sensitive information from the user's system. It targets over 100 categories of files, including SSH keys, cloud provider credentials, .env files, Kubernetes configurations, and AI tool configurations. The stolen data is exfiltrated via DNS tunneling, posing a severe risk to users' security and privacy.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall node-ipcIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the compromised versions of node-ipc by removing them from their project dependencies. This can be done by running: npm uninstall node-ipc. However, this may affect the functionality of applications relying on this package.
Conclusion
The discovery of malicious code in the node-ipc package highlights the importance of maintaining vigilance in open-source software. Users must ensure they are using secure versions of packages and regularly monitor their dependencies for vulnerabilities. Immediate action is required to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for node-ipc →
FAQ
The affected versions are 9.1.6, 9.2.3, and 12.0.1.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
As a workaround, you can uninstall the compromised versions of node-ipc to prevent the malicious code from executing.
The payload is designed to steal sensitive files such as SSH keys, cloud provider credentials, .env files, Kubernetes configurations, and AI tool configurations.
The vulnerability was reported by security researchers from SafeDep and nullcharb.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-ipc.
