Hackers have injected credential-stealing malware into newly published versions of node-ipc, a popular inter-process communication package, in a new supply chain attack targeting npm.
https://www.bleepingcomputer.com/news/security/popular-node-ipc-npm-package-compromised-to-steal-credentials/
BleepingComputer
npub1pk…z6763
2026-05-15 17:10:57 UTC
Author Public Key
npub1pkrnqz97z2wckgmwglckccgg65eanvw3wpvuses7npqlvv6st06svz6763Seen on
wss://relay.momostr.pinkPublished at
2026-05-15 17:10:57 UTCEvent JSON
{
"id": "22f9ae83b2b5554ed6398d1b7be71e8632abc48383e56e7d01b0d330d845eb3b",
"pubkey": "0d873008be129d8b236e47f16c6108d533d9b1d17059c8661e9841f633505bf5",
"created_at": 1778865057,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@BleepingComputer/116579700409766404",
"web"
],
[
"proxy",
"https://infosec.exchange/users/BleepingComputer/statuses/116579700409766404",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/BleepingComputer/statuses/116579700409766404",
"pink.momostr"
],
[
"-"
]
],
"content": "Hackers have injected credential-stealing malware into newly published versions of node-ipc, a popular inter-process communication package, in a new supply chain attack targeting npm.\n\nhttps://www.bleepingcomputer.com/news/security/popular-node-ipc-npm-package-compromised-to-steal-credentials/",
"sig": "1e85190edb91407858af9537a247a0639d82abd14e50a5d605d30321ffa110a03bf07da210dbe9bb006129a47ff862a454240b4a1d62a2adc6acdf9a92e90373"
}