SlowMist warns of malicious node-ipc versions 9.1.6, 9.2.3, and 12.0.1 stealing cloud and dev credentials; immediate downgrade and secret rotation required.
Security & Exploits ·
Security firm SlowMist has identified an active supply chain attack targeting node-ipc, a foundational Node.js library, with three malicious versions—9.1.6, 9.2.3, and 12.0.1. The attack injects obfuscated code into the CommonJS bundle that harvests over 90 categories of developer credentials and infrastructure data, including AWS, Azure, GCP, SSH, Kubernetes tokens, and Terraform states, before sending them to attacker-controlled servers.
Organizations should audit their environments by checking npm dependency trees for direct or transitive inclusions of affected versions, scanning lock files for the vulnerable version ranges, and reviewing CI/CD pipeline executions after May 14, 2026, that may have auto-updated to loose semver versions such as ~9.1.x or ^12. If a compromised version was installed, the compromise should be assumed certain and immediate action taken.
The remediation path requires downgrading to a safe version and rotating all credentials, tokens, and environment secrets present on affected machines or CI runners. SlowMist has synchronized indicators of compromise with its clients but the scope of real-world exposure and the number of projects already affected remain unknown.