Question 1

أي إصدارات من node-ipc تحتوي على البرمجيات الخبيثة؟

Accepted Answer

Versions 9.1.6, 9.2.3, and 12.0.1. SlowMist and StepSecurity both flagged them. All three had the same obfuscated payload that runs as soon as you load the package.

Question 2

كيف استولى المهاجم على حساب المسؤول؟

Accepted Answer

The original maintainer's email domain, atlantis-software.net, expired January 10, 2025. Attacker re-registered it through Namecheap on May 7, 2026, then used npm's password-reset process to grab the account. Maintainer never knew it happened, per StepSecurity's analysis reported by Bitcoin.com.

Question 3

ماذا يسرق المستولي بالضبط؟

Accepted Answer

Over 90 categories of secrets. AWS tokens, Google Cloud and Azure credentials, SSH keys, Kubernetes configs, GitHub CLI tokens, shell history files, and .env files, which often hold crypto private keys and exchange API secrets. Bitcoin.com reported the full breakdown.

StepSecurity

مهاجمون يختطفون حساب مشرف npm، ويسرقون مفاتيح العملات المشفرة

ملخص حاد وموجز.
كل يوم.

StepSecurity

مهاجمون يختطفون حساب مشرف npm، ويسرقون مفاتيح العملات المشفرة

ملخص حاد وموجز.كل يوم.

ملخص حاد وموجز.
كل يوم.