The Node-IPC Incident

An open source developer's commentary on what happened.

The Node-IPC Incident The Node-IPC Incident An open source developer's commentary on what happened. Eric Zhang • March 19, 2022 I’ve seen the node-ipc package incident kind of blow up recently, and it’s even being covered in popular non-technical news outlets like Vice . However in almost all sources, even among developers, there is a lot of misinformation and trolls. The intense political climate doesn’t help either. Here’s my attempt at describing the incident to a non-technical audience, as someone deeply invested in the open source and web development communities. S

related reading

• Assessing Claude Mythos Preview’s cybersecurity capabilities \ Anthropicred.anthropic.com
• NPM Install Everything, and the Complete and Utter Chaos That Followsboehs.org
• Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies | by Alex Birsan | Mediummedium.com
• Security incident disclosure — July 2026huggingface.co
• npm left-pad incident - Wikipediaen.wikipedia.org
• Defining A Software Supply Chain Security Platform & Exploring New Techniques, Part 2softwareanalyst.substack.com
• We should all be using dependency cooldownsblog.yossarian.net
• What's Really Going On Inside Your node_modules Folder? - So...socket.dev
• Snyk on X: "@karpathy The LiteLLM dependency incident didn't "just happen" though. This is part of a larger campaign LiteLLM already extends to supply chain security fallout for other projects: https://t.co/7bL3kNHP15" / Xx.com
• State of DevSecOps | Datadogdatadoghq.com
• Ultralytics AI Library Hacked via GitHub for Cryptomining | Wiz Blogwiz.io
• Measuring LLMs' impact on N-day exploits \ Anthropicred.anthropic.com