# Backdoored node-ipc npm releases steal developer credentials through DNS queries

DevFeed: [Backdoored node-ipc npm releases steal developer credentials through DNS queries](<https://devfeed.tech/articles/backdoored-node-ipc-npm-releases-steal-developer-credentials-through-dns-queries-8294.md>)

Original publisher: [Read original article](<https://securitylabs.datadoghq.com/articles/node-ipc-npm-malware-analysis/>)

Author: Nick Frichette

Published: 2026-05-14T00:00:00Z

Content type: article

Language: en

Sources: [Datadog Security Labs](<https://devfeed.tech/sources/datadog-security-labs.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [npm](<https://devfeed.tech/topics/npm.md>), [backdoor](<https://devfeed.tech/topics/backdoor.md>), [payload](<https://devfeed.tech/topics/payload.md>), [Amazon Route 53](<https://devfeed.tech/topics/amazon-route-53.md>), [Code](<https://devfeed.tech/topics/code.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Databases](<https://devfeed.tech/topics/databases.md>), [OpenSSH](<https://devfeed.tech/topics/openssh.md>)

Tags: [analysis](<https://devfeed.tech/tags/analysis.md>), [backdoor](<https://devfeed.tech/tags/backdoor.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [code](<https://devfeed.tech/tags/code.md>), [database](<https://devfeed.tech/tags/database.md>), [developer](<https://devfeed.tech/tags/developer.md>), [dns](<https://devfeed.tech/tags/dns.md>), [fork](<https://devfeed.tech/tags/fork.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [malware](<https://devfeed.tech/tags/malware.md>), [npm](<https://devfeed.tech/tags/npm.md>), [payload](<https://devfeed.tech/tags/payload.md>), [process](<https://devfeed.tech/tags/process.md>), [ssh](<https://devfeed.tech/tags/ssh.md>)

## AI overview

This article analyzes three backdoored node-ipc releases published to npm on May 14, 2026. The malicious CommonJS entrypoint launches a detached process, collects environment, host, developer, cloud, package manager, source control, Kubernetes, database, and SSH credentials, archives the data, and attempts DNS TXT exfiltration.

## Source excerpt

An analysis of backdoored node-ipc npm releases that add an obfuscated credential collection and DNS exfiltration payload to the CommonJS entrypoint.