Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, with a CVSS score of 3.3, published 16 March 2022.

Which products and versions are affected?

node-ipc (npm) SEMVER:introduced=11.0.0,fixed=12.0.0.

Is there a fix for This vulnerability?

Yes. node-ipc (npm): upgrade to 12.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run node-ipc (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

RIAEvangelist node-ipc unauthorized message delivery on desktop

Severity: info · CVSS 3.3 · Published 2022-03-16

The node-ipc library, a tool used for communication between different software processes, was updated by its maintainer to include code that writes a political message to the user's desktop. While this specific version does not delete data, it represents a "protestware" behavior where a developer intentionally alters software to display unsolicited messages. Organizations using this library should ensure they are not using the affected versions to avoid unexpected system behavior and potential reputational risks.

Technologies: node-ipc (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, with a CVSS score of 3.3, published 16 March 2022.
Which products and versions are affected?: node-ipc (npm) SEMVER:introduced=11.0.0,fixed=12.0.0.
Is there a fix for This vulnerability?: Yes. node-ipc (npm): upgrade to 12.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run node-ipc (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

node-ipc (npm): upgrade to 12.0.0 or later
```
npm install node-ipc@12.0.0
```

Technical details

The maintainer of node-ipc introduced a behavior change in version 11.0.0 (often categorized as protestware) that programmatically creates a file on the user's desktop containing a message regarding the Russia-Ukraine conflict. This action is triggered automatically upon the library's execution. While this specific version range (11.x) is distinct from the more destructive 'peacemail' versions that targeted specific IP ranges to overwrite files, it still constitutes unauthorized file system modification. The issue was addressed in version 12.0.0 by reverting the library to a clean state based on version 10.1.0. Users are advised to upgrade to version 12.0.0 or downgrade to 10.1.0.

Affected products

RIAEvangelist node-ipc >= 11.0.0, < 12.0.0

Timeline

2022-03-16: disclosed: Advisory published for behavior change in version 11.0.0.
2022-03-16: patched: Version 12.0.0 released to revert changes.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.