Three versions of the npm package node-ipc (9.1.23, 9.2.3, 10.1.1) contain malware that steals developer and cloud access credentials upon package loading and transmits them to a C2 server, targeting over 90 categories of login credentials.

Three versions of the popular Node-IPC npm package were infected with stealer malware that exfiltrates up to 90 categories of developer and cloud secrets, published by an unauthorized account and sending data to external C2 servers.