Question 1

어떤 node-ipc 버전이 악성 코드를 포함하고 있나요?

Accepted Answer

Versions 9.1.6, 9.2.3, and 12.0.1. SlowMist and StepSecurity both flagged them. All three had the same obfuscated payload that runs as soon as you load the package.

Question 2

공격자는 어떻게 유지 관리자 계정을 장악했나요?

Accepted Answer

The original maintainer's email domain, atlantis-software.net, expired January 10, 2025. Attacker re-registered it through Namecheap on May 7, 2026, then used npm's password-reset process to grab the account. Maintainer never knew it happened, per StepSecurity's analysis reported by Bitcoin.com.

Question 3

스틸러가 실제로 무엇을 가져갑니까?

Accepted Answer

Over 90 categories of secrets. AWS tokens, Google Cloud and Azure credentials, SSH keys, Kubernetes configs, GitHub CLI tokens, shell history files, and .env files, which often hold crypto private keys and exchange API secrets. Bitcoin.com reported the full breakdown.

Namecheap

공격자가 npm 유지 관리자 계정을 하이재킹하여 암호화폐 키를 탈취

날카로운 한 줄.
매일.

Namecheap

공격자가 npm 유지 관리자 계정을 하이재킹하여 암호화폐 키를 탈취

날카로운 한 줄.매일.

날카로운 한 줄.
매일.