Three node-ipc npm releases, 9.1.6, 9.2.3, and 12.0.1, were published on May 14, 2026 with a backdoored CommonJS entrypoint that collects credentials and host data. The payload exfiltrates archives over DNS to sh.azurestaticprovider.net:443 using TXT queries under bt.node.js, with indicators including node-ipc.cjs, __ntw=1, and the affected package versions. #node-ipc #sh.azurestaticprovider.net #bt.node.js
Keypoints
- Three malicious node-ipc releases were published to npm: 9.1.6, 9.2.3, and 12.0.1.
- The backdoor lives in the CommonJS entrypoint node-ipc.cjs and executes when the package is loaded with require(“node-ipc”).
- The payload collects environment variables, host information, /etc/hosts, and many credential files from developer, cloud, source control, Kubernetes, SSH, and application stores.
- Exfiltration is DNS-based, using TXT queries to a decoded endpoint of sh.azurestaticprovider.net:443 and query names under bt.node.js.
- The malware forks a detached child process with __ntw=1, builds a gzip-compressed tar archive, and deletes the temporary archive after use.
- Static indicators include the node-ipc.cjs SHA-256 hash, the archive naming pattern under nt-, and encoded configuration strings such as the embedded key material and custom alphabet.
- Defenders are advised to inventory dependencies, block the DNS endpoint and public resolvers, and rotate exposed credentials if affected versions were loaded at runtime.
MITRE Techniques
- [T1059.006 ] Command and Scripting Interpreter: JavaScript – Executes malicious logic through the Node.js CommonJS entrypoint when loaded via require(“node-ipc”) (‘runs when the package’s CommonJS entrypoint is loaded’).
- [T1105 ] Ingress Tool Transfer – Prepares and stages collected data into a gzip-compressed tar archive for exfiltration (‘builds a gzip-compressed tar archive’).
- [T1036 ] Masquerading – Uses benign-looking package behavior and filenames while hiding malicious collection and exfiltration logic in node-ipc.cjs (‘backdoored CommonJS entrypoint’).
- [T1027 ] Obfuscated Files or Information – Encodes archive data with gzip, base64, XOR, and a shuffled alphabet before DNS transmission (‘XORs that text with a SHA-256-derived keystream’).
- [T1041 ] Exfiltration Over C2 Channel – Sends stolen data out through DNS TXT queries to a remote endpoint (‘attempts to exfiltrate that archive through DNS TXT queries’).
- [T1071.004 ] Application Layer Protocol: DNS – Uses DNS as the command-and-control and transport channel (‘the command and control (C2) channel uses DNS, not HTTP’).
- [T1005 ] Data from Local System – Collects local files such as /etc/hosts, uname output, environment variables, and credential files (‘collects host and credential files into an archive’).
- [T1082 ] System Information Discovery – Gathers host fingerprinting data including uname -a and host information (‘Output from uname -a, when available’).
- [T1033 ] System Owner/User Discovery – Uses environment and host-derived information to fingerprint the machine and build identifiers (‘machineHex is derived from host fingerprinting’).
- [T1021 ] Remote Services – Leverages SSH and Kubernetes-related credentials among the collected targets (‘SSH and Kubernetes material’).
Indicators of Compromise
- [Package versions ] Affected npm releases – [email protected], [email protected], and [email protected]
- [File hashes ] Backdoored package file and tarballs – node-ipc.cjs SHA-256 96097e0612d9575cb133021017fb1a5c68a03b60f9f3d24ebdc0e628d9034144, tarball SHA-256 449e4265979b5fdb2d3446c021af437e815debd66de7da2fe54f1ad93cbcc75e, and 2 more hashes
- [Domains ] DNS exfiltration host and suffix – sh.azurestaticprovider.net, bt.node.js
- [IP addresses ] Observed resolver endpoint and public resolvers – 37.16.75.69, 8.8.8.8, and 1.1.1.1
- [File names ] Malicious package file and archive artifacts – node-ipc.cjs, *.tar.gz, and temp directories like nt-
- [File paths ] Targeted credential and secret locations – ~/.aws/credentials, ~/.ssh/id_rsa, ~/.kube/config, /etc/hosts, and other secret files
- [Environment variables ] Execution marker and collection output – __ntw=1, envs.txt, and host-fingerprint-related variables
- [Query patterns ] DNS TXT exfiltration labels – xh.{machineHex}.{sessionId}…, xd.{machineHex}.{sessionId}…, and xf.{machineHex}.{sessionId}…
Read more: https://securitylabs.datadoghq.com/articles/node-ipc-npm-malware-analysis/