PT-2022-16282 · Npm · Node-Ipc

Tyler Resch

+1

·

Published

2022-03-16

·

Updated

2026-05-18

·

CVE-2022-23812

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions node-ipc versions 10.1.1 through 10.1.2
Description The issue concerns malicious code embedded in the node-ipc package, targeting users with IP addresses located in Russia or Belarus. This code overwrites files with a heart emoji. The package has around a million downloads per week and is used as a dependency by 354 packages, including vue-cli. All projects with node-ipc in their dependencies are also affected. The malicious code is activated with a 25% probability and affects systems with IP addresses from Russia or Belarus.
Recommendations For node-ipc versions 10.1.1 through 10.1.2, update to version 10.1.3 or later to resolve the issue. As a temporary workaround, consider disabling the use of the node-ipc package until a patch is available. Restrict access to the node-ipc package to minimize the risk of exploitation. Avoid using the node-ipc package in projects that require high security standards until the issue is fully resolved.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-506CWE-94

Related Identifiers

CVE-2022-23812
GHSA-97M3-W2CP-4XX6
SNYK-JS-NODEIPC-2426370

Affected Products

Node-Ipc