Node-ipc supply chain attack targets crypto devs
Researchers at StepSecurity figured out how the attack happened. The original developer of node-ipc had an email address tied to the domain atlantis-software[.]net. However, the domain expired on January 10, 2025. On May 7, 2026, the attacker bought the same domain through Namecheap, which gave them control of the developers old email. From there, they just hit “forgot password” on npm, reset it, and walked right in with full permission to publish new versions of node-ipc. The real developer had no clue any of this was happening. The malicious versions stayed live for about two hours before removal. The embedded payload hunts for over 90 types of developer and cloud credentials. AWS tokens, Google Cloud and Azure secrets, SSH keys, Kubernetes configs, GitHub CLI tokens, all on the list. For crypto devs, the malware specifically raids .env files. Those usually hold private keys, RPC node credentials, and exchange API secrets. To sneak the stolen data out, the payload uses DNS tunneling. It basically hides the files inside normal-looking internet lookup requests. Most network security tools dont catch that. Security teams are saying any project that ran npm install or had auto-updated dependencies during that two hour window should assume compromise. Immediate steps, per guidance from SlowMist:Check lock