node-ipc 9.1.6 / 9.2.3 / 12.0.1 DNS-exfil stealer

SafeDep: maintainer-account takeover of node-ipc published 9.1.6,
9.2.3 and 12.0.1 with an 80KB obfuscated credential stealer using DNS
exfiltration. Distinct from the 2022 protestware incident.

Mapped techniques

T0113 Compromised user account
T0121 Compromised legitimate artifact
T0145 Bypass of outbound traffic control
T0100 Discover naming conventions

supply-chain ato plus dns exfil

T0113 · Initial Access · Compromised user account

Maintainer account takeover.

T0121 · Resource Development · Compromised legitimate artifact

node-ipc 9.1.6, 9.2.3, 12.0.1.

T0145 · Exfiltration · Bypass of outbound traffic control

DNS exfiltration of credentials.

T0100 · Reconnaissance · Discover naming conventions

Company internals discovered via docs/DNS to mirror private names.

Sources

https://safedep.io/malicious-node-ipc-npm-compromise
https://socket.dev/blog/node-ipc-package-compromised
https://snyk.io/blog/peacenotwar-protestware-node-ipc-package-vulnerability/
https://github.com/advisories/GHSA-97m3-w2cp-4xx6