# node-ipc npm compromise teardown: an expired email domain > How an expired email domain likely handed a dormant node-ipc co-maintainer account to an attacker, what the DNS stealer took, and whether Chainsaw stops it. Source: https://chain305.com/teardowns/node-ipc-expired-domain/ --- # Teardown: the node-ipc npm compromise A lapsed email domain, a likely password reset, and a stealer that sent secrets out over DNS. What happened on 14 May 2026, how an expired domain can become a publish key, and where Chainsaw would and would not have stopped it. By [Muhammad Zeeshan Sultan](https://chain305.com/about/#founder), founder of Chain305 · October 2026 Questions and answers ## What happened? On 14 May 2026, three malicious versions of node-ipc, a Node.js library for inter-process communication, went up on npm within about a minute: `12.0.1` at 14:25 UTC, tagged `latest`, then `9.2.3` and `9.1.6`. SafeDep, working from npm registry metadata, says the three releases spanned 56 seconds and were tagged to maximise install coverage. Each carried the same obfuscated credential stealer of about 80 KB. The OSV malware entry for them, MAL-2026-3744, was published at 16:53 UTC the same day. Reported reach varies: CSO Online cites almost 700,000 weekly downloads and 424 dependent projects, SafeDep about 822,000 weekly downloads. The project’s owner confirmed in the GitHub repository that the last official release was `12.0.0`, and Depi found no matching source in the repository for any of the three versions. ## How did the attacker get publish rights? Most likely by taking over the email domain of a dormant co-maintainer and resetting the npm password. node-ipc lists several maintainers with publish rights. The malicious versions came from a co-maintainer account that, according to Depi and Snyk, had never published node-ipc before. Depi found its last publish of any package was in April 2022. The technique, as the sources describe it: 1. **The account’s email address sat on a custom domain**, `atlantis-software.net`, belonging to a company that, as far as Depi could tell from public records, no longer exists. 2. **The domain was allowed to expire.** CSO Online gives January 2025 as the expiry. 3. **Someone re-registered it and set up mail.** Depi found the new registration at Namecheap with mail records pointing to Namecheap’s hosted email service. 4. **That person could then ask npm for a password reset.** The reset email goes to the account’s address, and whoever controls the domain receives it. No break-in to the maintainer, the repository or the CI pipeline is needed. CSO Online suggests attackers search npm for accounts on custom domains and check which of those domains have lapsed, and warns that other dormant accounts may be open to the same method. The sources disagree on the re-registration date. Depi, citing public WHOIS and DNS records, says 10 March 2026. Snyk, citing public reporting, gives 7 May 2026, a week before the attack. CSO Online says earlier in May. The sources also stop short of proof. Depi calls email takeover its working hypothesis and says it did not observe the password reset. Snyk calls the expired domain “an attribution and root-cause lead rather than complete proof”. None of the sources says whether the account had two-factor authentication. ## What changed in the package? The malicious node-ipc versions published on 14 May 2026 changed the CommonJS entry point. The payload sits in `node-ipc.cjs`, the file Node loads for `require("node-ipc")`, and is byte-identical across all three versions, according to SafeDep: - **`12.0.1`:** `node-ipc.cjs` was replaced with a prebuilt bundle with the payload appended after `module.exports`, and the `prepare` build script was removed from `package.json`. - **`9.1.6`:** `9.1.5` had no `node-ipc.cjs`. The attacker added one, pointed `main` at the new file and restructured the package to match the 12.x line. The library kept working as before, which CSO Online says was meant to delay detection. Socket and Snyk report the ESM entry point was not changed in the same way. One contribution to the OSV entry additionally describes geolocation lookups and file overwriting in `9.2.3`, which resembles node-ipc’s 2022 protestware incident. The code analyses from Socket, SafeDep and Snyk describe only the credential stealer. ## What ran on install? The node-ipc stealer ran nothing at install time. There is no `postinstall` hook: the stealer runs whenever an application or tool loads the package with `require`, including as a dependency of something else. Then, according to Socket and SafeDep, the stealer: - **Collected host details:** OS version, hostname, the output of `uname -a`, and every environment variable. - **Gathered files from 113 or 127 path patterns, depending on the operating system** (SafeDep and CSO Online disagree on which OS gets which list), covering AWS, Azure, GCP and other cloud credentials, SSH keys, kubeconfig and Docker config, `.npmrc`, `.git-credentials`, Terraform credentials, `.env` files, shell histories, macOS Keychain databases, and AI coding tool configs, for example `~/.claude.json` and MCP settings. - **Packed the files into a gzipped tar archive** in an `nt-` directory. SafeDep places the directory under the home directory, Socket and Snyk under the system temp directory. - **Sent the archive out over DNS.** The stealer split the archive into chunks and sent the chunks as DNS TXT queries straight to `1.1.1.1` and `8.8.8.8`, with `sh.azurestaticprovider[.]net`, a lookalike of Azure Static Web Apps, as the bootstrap. Socket names `bt.node[.]js` as the exfiltration zone and estimates about 29,400 queries for a 500 KiB archive. - **Kept running after its parent exited,** in a detached child process. Socket reports no persistence in the decoded sample and no second-stage download. The damage is whatever the stealer collected and sent while running. ## Would Chainsaw have stopped it? Yes, for installs that go through the Chainsaw proxy, through the release hold and the malware feed, not on day 0. This comes from our re-run of 58 attacks from 2026 against production Chainsaw (v0.22.118) on 19 October 2026, with default policy: - **The malicious versions are held back.** Chainsaw holds every new npm version for 48 hours by default, so an unpinned `npm install node-ipc` resolves to `12.0.0`. The known-malicious feed listed all three versions about 2.5 hours after publish, so they stay refused after the hold ends. - **The publisher change is flagged, not refused.** Chainsaw’s publisher-change signal fires on these versions: a co-maintainer who had never published node-ipc released the package’s first version in 21 months. The default rule that uses it only monitors, so on its own it records the change and lets the install through. - **The package bytes are not refused.** The stealer runs on `require` and sends data out through DNS lookups, and Chainsaw’s import-time execution rule does not match it. Before the feed listing, only the hold stands between a request and these versions. - **The account takeover itself happens outside Chainsaw.** The domain re-registration and the password reset happen at the domain registrar and at npm, where Chainsaw has no view. - **Installs that bypass the proxy get the malware.** A machine pointed straight at registry.npmjs.org is not protected. That is why Chainsaw also gates CI, pins laptops through MDM and blocks direct registry traffic at the network. ## What should you do? Any machine, container build or CI runner where `node-ipc` `9.1.6`, `9.2.3` or `12.0.1` was installed and loaded should be treated as compromised, according to GitHub’s advisory and the researchers. First find every copy (step 1), then rotate every credential the host could reach from a different computer (step 2). 1. **Find every copy.** Run `npm ls node-ipc`, and search lockfiles, build caches and the npm cache, including where node-ipc arrives through another package. 2. **Rotate every credential the host could reach, from a different computer:** SSH keys, npm, GitHub, cloud, Kubernetes, Docker, Terraform and database credentials, AI tool keys, and anything in environment variables or `.env` files. CSO Online adds credentials stored in the macOS Keychain. 3. **Look for traces,** for example `nt-*` directories in home and temp directories and detached Node.js processes, and search DNS logs for `azurestaticprovider[.]net`, `bt.node[.]js` and bursts of TXT queries. 4. **Pin a clean version.** SafeDep names `12.0.0` and `9.1.5` as clean. For the next one: 1. **Watch for releases after long silences and from new publishers.** Snyk recommends monitoring maintainer changes and release activity after long periods of inactivity, and avoiding auto-consuming new releases through cooldowns or proxy policies. 2. **Remove stale maintainers and check their email domains.** If you publish packages, review who still has publish rights and whether each address sits on a still-registered domain. CSO Online, Snyk and Depi all point to dormant accounts on lapsed domains as the weak spot. 3. **Use MFA on publisher accounts.** Snyk recommends enforcing MFA for npm publishers. 4. **Review entry points, not only install scripts.** Turning off install scripts would not have helped with node-ipc, since the code ran on `require`. Socket recommends checking what a package’s entry point does. ## Sources - SafeDep, [Compromised node-ipc on npm: Credential Stealer via DNS Exfiltration](https://safedep.io/malicious-node-ipc-npm-compromise/), 14 May 2026. - Socket, [Popular node-ipc npm Package Infected with Credential Stealer](https://socket.dev/blog/node-ipc-package-compromised), 14 May 2026. - CSO Online, [Expired domain leads to supply chain attack on node-ipc npm package](https://www.csoonline.com/article/4171926/expired-domain-leads-to-supply-chain-attack-on-node-ipc-npm-package.html), 15 May 2026. - Snyk, [Malicious node-ipc versions published to npm](https://snyk.io/blog/malicious-node-ipc-versions-published-npm/), 15 May 2026. - Depi, [node-ipc Compromised: A Dormant Maintainer, an Expired Domain, and What We Think Happened](https://depi.security/blog/20260514-node-ipc-compromised/). - OSV, [MAL-2026-3744](https://osv.dev/vulnerability/MAL-2026-3744), 14 May 2026. - GitHub Advisory Database, [GHSA-pvh2-rg5g-69v7: Malware in node-ipc](https://github.com/advisories/GHSA-pvh2-rg5g-69v7). - RIAEvangelist/node-ipc, [issue #15: CJS bundle contains obfuscated infostealer payload](https://github.com/RIAEvangelist/node-ipc/issues/15). One teardown per notable attack ## Get the next teardown by email What happened, the install-path angle most coverage misses, and the rule that refuses it. [Subscribe to teardowns](https://chain305.com/teardowns/) [Read what a package firewall catches →](https://chain305.com/what-is-a-package-firewall/)