Tag

iife

Safeguard articles tagged "iife" — guides, analysis, and best practices for software supply chain and application security.

1 article

Supply Chain Attacks

node-ipc Compromised Again (14 May 2026): An 80 KB Credential Stealer in a 10M-Download Library

On 14 May 2026, three malicious node-ipc versions (9.1.6, 9.2.3, 12.0.1) shipped an 80 KB credential-stealing IIFE appended after module.exports in the CJS bundle — no install scripts, harvesting 90+ secret categories from a library with 10M+ weekly downloads.

May 15, 20269 min read