# node malware

Published articles for node malware.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Node-ipc compromised: Credential stealer targets package with 500k+ weekly downloads

DevFeed: [Node-ipc compromised: Credential stealer targets package with 500k+ weekly downloads](<https://devfeed.tech/articles/node-ipc-compromised-credential-stealer-targets-package-with-500k-weekly-downloads-13188.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/node-ipc-compromised-credential-stealer-targets-package-with-500k-weekly-downloads>)

Published: 2026-05-14T00:00:00Z

Content type: news

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [Node.js](<https://devfeed.tech/topics/node-js.md>), [Security](<https://devfeed.tech/topics/security.md>), [npm](<https://devfeed.tech/topics/npm.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>), [ssh](<https://devfeed.tech/topics/ssh.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [API keys](<https://devfeed.tech/topics/api-keys.md>), [CommonJS](<https://devfeed.tech/topics/commonjs.md>), [Claude](<https://devfeed.tech/topics/claude.md>), [Terraform](<https://devfeed.tech/topics/terraform.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [api-keys](<https://devfeed.tech/tags/api-keys.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [claude](<https://devfeed.tech/tags/claude.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [commonjs](<https://devfeed.tech/tags/commonjs.md>), [dns](<https://devfeed.tech/tags/dns.md>), [github](<https://devfeed.tech/tags/github.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [malware](<https://devfeed.tech/tags/malware.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [node](<https://devfeed.tech/tags/node.md>), [node-ipc](<https://devfeed.tech/tags/node-ipc.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [node-malware](<https://devfeed.tech/tags/node-malware.md>), [node-worm](<https://devfeed.tech/tags/node-worm.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-malware](<https://devfeed.tech/tags/npm-malware.md>), [payload](<https://devfeed.tech/tags/payload.md>), [security](<https://devfeed.tech/tags/security.md>), [sha-256](<https://devfeed.tech/tags/sha-256.md>), [shai-hulud](<https://devfeed.tech/tags/shai-hulud.md>), [ssh](<https://devfeed.tech/tags/ssh.md>), [terraform](<https://devfeed.tech/tags/terraform.md>)

### AI overview

Three malicious versions of the node-ipc npm package harvested and exfiltrated credentials from cloud providers, SSH, Kubernetes, CI/CD, version-control tools, and AI APIs. The article reports that Chainguard customers were not affected.

### Source excerpt

Malicious node-ipc packages stole cloud, SSH, Kubernetes, and AI keys. Chainguard customers stayed protected through source-built libraries.