Three poisoned versions of node-ipc went live on the npm registry on May 14, according to SlowMist. Attackers hijacked a dormant maintainer account and pushed code designed to siphon developer credentials, private keys, exchange API secrets, the works, straight out of .env files.

node-ipc is a popular Node.js package that lets different programs talk to each other on the same machine, or sometimes across a network.

SlowMist catches the breach

Blockchain security firm, SlowMist, spotted the breach through their MistEye threat intel system.

Versions 9.1.6, 9.2.3, and 12.0.1

MistEye found three malicious versions including:

• Version 9.1.6.
• Version 9.2.3.
• Version 12.0.1.

All of the above verions carried the same obfuscated 80 KB…