# CVE-2022-23812: npm node-ipc embedded malicious code

Source: https://junglewise.ai/threats/cve-2022-23812-npm-node-ipc-embedded-malicious-code  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-03-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-23812 · Severity: low · CVSS 3.1 · Published 2022-03-16

node-ipc is a popular Node.js library for inter-process communication used by many applications. Versions 10.1.1 and 10.1.2 contained intentionally injected malicious code that could overwrite arbitrary files on affected systems based on the user's geographic location. This could allow attackers to corrupt or replace critical files, leading to system compromise, data loss, or application failure.

Technologies: [node-ipc (npm)](https://junglewise.ai/threats/technologies/node-ipc). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-23812 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-23812 being exploited in the wild.

**How severe is CVE-2022-23812?** Low severity, with a CVSS score of 3.1, published 16 March 2022.

**Which products and versions are affected?** node-ipc (npm) 10.1.1, 10.1.2.

**Is there a fix for CVE-2022-23812?** A patch was published on 2022-03-16: Version 10.1.3 removed malicious code Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-23812 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-23812?** Check whether you run node-ipc (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The node-ipc library versions 10.1.1 and 10.1.2 contained embedded malicious code (CWE-506: Embedded Malicious Code) introduced by the maintainer. The malicious payload, located in the ssl-geospec.js module, performed geolocation-based file system operations to overwrite arbitrary files without authorization (CWE-94: Improper Control of Generation of Code). The attack vector is network-based with no authentication or user interaction required—simply installing or updating to the vulnerable versions would trigger the malicious code execution. The maintainer removed the malicious code in version 10.1.3. Any application depending on node-ipc versions 10.1.1 or 10.1.2 can be exploited to perform unauthorized file modifications.

## Affected products

- npm node-ipc 10.1.1, 10.1.2

## Identifiers

- CVE-2022-23812
- GHSA-97m3-w2cp-4xx6

## Timeline

- 2022-03-16: disclosed
- 2022-03-16: patched: Version 10.1.3 removed malicious code

## References

- [https://github.com/RIAEvangelist/node-ipc/issues/233](https://github.com/RIAEvangelist/node-ipc/issues/233)

## Related threats

- [RIAEvangelist node-ipc unauthorized message delivery on desktop](https://junglewise.ai/threats/riaevangelist-node-ipc-unauthorized-message-delivery-on-desktop-4627ec5d)
- [node-ipc hidden functionality and malicious payload injection](https://junglewise.ai/threats/node-ipc-hidden-functionality-and-malicious-payload-injection-e7f1e671)