CVE-2022-23812

🗓️ 16 Mar 2022 15:45:31Reported by snykType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 128 Views🌐 WEB

Node-ipc package v10.1.1-v10.1.3 contains malicious code targeting Russia/Belarus IPs & overwriting files with heart emoji. **Note**: v11.0.0+ imports peacenotwar package with potential undesired behavior

Reporter	Title	Published	Views	Family All 21
attackerkb	CVE-2022-23812	16 Mar 202215:41	–	attackerkb
Circl	CVE-2022-23812	16 Mar 202219:20	–	circl
CNNVD	node-ipc 安全漏洞	16 Mar 202200:00	–	cnnvd
Cvelist	CVE-2022-23812 Malicious Package	16 Mar 202215:45	–	cvelist
EUVD	EUVD-2022-1390	3 Oct 202520:07	–	euvd
F5 Networks	K42801711: node-ipc vulnerability CVE-2022-23812	21 Feb 202318:34	–	f5
Github Security Blog	Embedded Malicious Code in node-ipc	16 Mar 202223:54	–	github
Kitploit	node-ipc-malware-protestware-CVE-2022-23812	12 Oct 202600:05	–	kitploit
Malwarebytes	Anti-war open-source software developer targets Russians and Belarussians with “protestware”	25 Mar 202200:07	–	malwarebytes
Mend	CVE-2022-23812	16 Mar 202215:45	–	mend

NVD

Vulners

Node

node-ipc_project node-ipcRange10.1.1–10.1.3node.js

node-ipc_project node-ipcRange11.0.0≥node.js

[
  {
    "product": "node-ipc",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "10.1.1",
        "versionType": "custom"
      },
      {
        "lessThan": "10.1.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/RIAEvangelist/node-ipc/issues/236
github	www.github.com/RIAEvangelist/node-ipc/blob/847047cf7f81ab08352038b2204f0e7633449580/dao/ssl-geospec.js
github	www.github.com/RIAEvangelist/node-ipc/commit/847047cf7f81ab08352038b2204f0e7633449580
snyk	www.snyk.io/vuln/SNYK-JS-NODEIPC-2426370
security	www.security.netapp.com/advisory/ntap-20220407-0005/
github	www.github.com/RIAEvangelist/node-ipc/issues/233

Parameter	Position	Path	Description	CWE
apiKey	query param	/ipgeo?apiKey=ae511e1627824a968aaaa758a5309154	External IP geolocation API call used by the malicious package to detect user country and trigger local file overwriting for Russia/Belarus.

17 Jun 2026 04:30Current

9.4Critical risk

Vulners AI Score9.4

CVSS 3.19.8

CVSS 210

EPSS0.0426

In Wild