# Node-ipc compromised: Credential stealer targets package with 500k+ weekly downloads

DevFeed: [Node-ipc compromised: Credential stealer targets package with 500k+ weekly downloads](<https://devfeed.tech/articles/node-ipc-compromised-credential-stealer-targets-package-with-500k-weekly-downloads-13188.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/node-ipc-compromised-credential-stealer-targets-package-with-500k-weekly-downloads>)

Published: 2026-05-14T00:00:00Z

Content type: news

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [Node.js](<https://devfeed.tech/topics/node-js.md>), [Security](<https://devfeed.tech/topics/security.md>), [npm](<https://devfeed.tech/topics/npm.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>), [ssh](<https://devfeed.tech/topics/ssh.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [API keys](<https://devfeed.tech/topics/api-keys.md>), [CommonJS](<https://devfeed.tech/topics/commonjs.md>), [Claude](<https://devfeed.tech/topics/claude.md>), [Terraform](<https://devfeed.tech/topics/terraform.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [api-keys](<https://devfeed.tech/tags/api-keys.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [claude](<https://devfeed.tech/tags/claude.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [commonjs](<https://devfeed.tech/tags/commonjs.md>), [dns](<https://devfeed.tech/tags/dns.md>), [github](<https://devfeed.tech/tags/github.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [malware](<https://devfeed.tech/tags/malware.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [node](<https://devfeed.tech/tags/node.md>), [node-ipc](<https://devfeed.tech/tags/node-ipc.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [node-malware](<https://devfeed.tech/tags/node-malware.md>), [node-worm](<https://devfeed.tech/tags/node-worm.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-malware](<https://devfeed.tech/tags/npm-malware.md>), [payload](<https://devfeed.tech/tags/payload.md>), [security](<https://devfeed.tech/tags/security.md>), [sha-256](<https://devfeed.tech/tags/sha-256.md>), [shai-hulud](<https://devfeed.tech/tags/shai-hulud.md>), [ssh](<https://devfeed.tech/tags/ssh.md>), [terraform](<https://devfeed.tech/tags/terraform.md>)

## AI overview

Three malicious versions of the node-ipc npm package harvested and exfiltrated credentials from cloud providers, SSH, Kubernetes, CI/CD, version-control tools, and AI APIs. The article reports that Chainguard customers were not affected.

## Source excerpt

Malicious node-ipc packages stole cloud, SSH, Kubernetes, and AI keys. Chainguard customers stayed protected through source-built libraries.