Supply Chain Attack: Malicious Node-IPC Versions (v9.1.6, v9.2.3, v12.0.1) — Detection and Remediation

---
title: Potential Malicious Node-IPC Package Installation
id: 8a1f2c33-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects installation of known malicious node-ipc versions (9.1.6, 9.2.3, 12.0.1) via npm CLI.
references:
  - https://socket.dev/blog/detecting-and-blocking-the-peacenotwar-protestware-incident
  - https://stepsecurity.io
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\npm.exe'
      - '\npm.cmd'
    CommandLine|contains:
      - 'node-ipc@9.1.6'
      - 'node-ipc@9.2.3'
      - 'node-ipc@12.0.1'
  condition: selection
falsepositives:
  - Legitimate testing of specific package versions by developers
level: critical
---
title: Node.js Process Accessing Sensitive Credential Files
id: 9b2c3d44-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects Node.js processes accessing files typically associated with developer secrets (AWS, SSH, NPM), indicative of the node-ipc stealer behavior.
references:
  - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.credential_access
  - attack.t1005
logsource:
  category: file_access
  product: windows
detection:
  selection:
    Image|endswith:
      - '\node.exe'
    TargetFilename|contains:
      - '\.aws\credentials'
      - '\.ssh\id_rsa'
      - '\.npmrc'
      - '\.bashrc'
  condition: selection
falsepositives:
  - Legitimate deployment tools or credential managers
level: high

// Hunt for npm installations involving the specific malicious node-ipc versions
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessVersionInfoOriginalFileName in ("npm.exe", "node.exe") or FileName =~ "npm"
| where ProcessCommandLine has "node-ipc@9.1.6" 
   or ProcessCommandLine has "node-ipc@9.2.3" 
   or ProcessCommandLine has "node-ipc@12.0.1"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| extend Tactics = "Supply Chain"

-- Hunt for presence of malicious node-ipc versions in node_modules directories
SELECT FullPath, Mtime, Size
FROM glob(globs="/*/node_modules/node-ipc/package.")
WHERE -- Read the package. to check version (parsing logic simulated via string matching)
      read_file(filename=FullPath) =~ '9.1.6' 
      OR read_file(filename=FullPath) =~ '9.2.3' 
      OR read_file(filename=FullPath) =~ '12.0.1'

#!/bin/bash

# Remediation Script: Node-IPC Malicious Version Removal
# Target Versions: 9.1.6, 9.2.3, 12.0.1

MALICIOUS_VERSIONS=("9.1.6" "9.2.3" "12.0.1")
PACKAGE_NAME="node-ipc"
FOUND_MALICIOUS=0

echo "[+] Scanning for malicious $PACKAGE_NAME versions..."

# Check global packages
for version in "${MALICIOUS_VERSIONS[@]}"; do
  if npm list -g --depth=0 | grep -q "$PACKAGE_NAME@$version"; then
    echo "[!] REMOVING Global: $PACKAGE_NAME@$version"
    npm uninstall -g "$PACKAGE_NAME@$version"
    FOUND_MALICIOUS=1
  fi
done

# Check local projects (scanning current directory and subdirectories)
# Find all package-lock. files to verify installed versions
find . -name "package-lock." -type f | while read -r lockfile; do
  dir=$(dirname "$lockfile")
  echo "[+] Checking $dir"
  
  for version in "${MALICIOUS_VERSIONS[@]}"; do
    if grep -q ""node-ipc.*$version"" "$lockfile"; then
      echo "[!] MALICIOUS VERSION FOUND in $dir"
      echo "[!] Removing $PACKAGE_NAME from $dir"
      (cd "$dir" && npm uninstall "$PACKAGE_NAME")
      FOUND_MALICIOUS=1
    fi
  done
done

if [ "$FOUND_MALICIOUS" -eq 0 ]; then
  echo "[+] No malicious versions found in scanned locations."
else
  echo "[!] CRITICAL: Malicious versions were found and removed."
  echo "[!] ACTION REQUIRED: Rotate all API keys, tokens, and credentials used in this environment immediately."
fi