HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
RIAEvangelist
node-ipc
JavaScript2022–2026
RIAEvangelist / node-ipc

node-ipc

A nodejs module for local and remote Inter Process Communication (IPC), Neural Networking, and able to facilitate machine learning.

27Distinct people
29Mentions
0Explicit recommenders
67GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

A nodejs module for local and remote Inter Process Communication (IPC), Neural Networking, and able to facilitate machine learning.

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year29 dated mentions

Observed mentions: 2022-03-15 17:26:50 UTC to 2026-05-14 16:29:45 UTC.

01020302022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 28 mentions; 11 submissions, 17 comments20222023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments20242025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC281117
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC000
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC000
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC000
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC110

From the project README

An excerpt from the repository, fetched Nov 13, 2026.

Read the project’s introduction
node-ipc node-ipc 14.0.0 source for the aligned npm, NuGet, and crates.io release Fast local and remote process communication for Node.js, C#, and Rust on Linux, macOS, and Windows. The aligned implementations share the normal node-ipc event envelope and delimiter framing across local sockets, TCP, and UDP. A great solution for complex multiprocess Neural Networking in Node.JS npm install --save-exact node-ipc@14.0.0 Rust: cargo add node-ipc@14.0.0 --exact C#: dotnet add package node-ipc --version 14.0.0 Use an exact, reviewed version. Do not use a mutable tag or version range for security-sensitive deployments. Runtime Version 14 requires Node.js 22.13.0 or newer. The native ports require Rust 1.85 or newer and .NET 8 or newer. Version 12 remains the legacy Node release line; version 13 was never published. node-ipc ships native ES modules only. Node.js loads the same entry point through import or synchronous require(); no transpiled CommonJS bundle is generated. The node-ipc JavaScript package is Node.js-only. It uses Node's raw TCP, TLS, UDP, Unix-domain socket, Windows named-pipe, filesystem, OS, process, and Buffer APIs. It is not supported in browsers, with or without a bundler. “Native ESM” means that Node loads the one JavaScript implementation without a transpiler; it does not mean native-browser ESM. The documentation website's browser code is separate and is not part of the npm package runtime. Node.js runtime profiles The Node.js implementation selects its parser and hot-path handlers once, when each client or server is created. It does not poll a security flag for every message. Set the profile before calling connect*() or serve*(). Profile Work on every message Intended boundary raw No node-ipc framing, JSON parsing, or message checks. Buffers pass through the data event. Trusted peers using a caller-owned binary or text protocol. fast JSON event-envelope encoding/decoding and delimiter framing. Malformed JSON becomes a protocol error; stream connections close. Default for trusted local peers where the application owns payload validity. guarded Fast framing plus frame-size, stream pending-write, event-name, reserved/prototype-name, envelope, and incomplete-message-time controls. Mixed-trust local services and authenticated network applications. assured Guarded controls plus a required event allow-list. Network use requires mutually authenticated TLS; each Unix local server endpoint must be a direct child of the secure socket root. Built-in Windows local service is rejected because node-ipc cannot prove its named-pipe ACL. Hostile-network building block with verified peer certificates and application authorization; not a certification. ipc.config.parser = 'guarded'; ipc.config.maxMessageSize = 1024 * 1024; ipc.config.maxPendingBytes = 8 * 1024 * 1024; These transport guarantees are Node.js-specific. Rust shares the four codec profiles but requires the caller to establish and verify the transport boundary. See Profiles, Parsers, and Security before choosing a network-facing configuration. Rust The paired Rust crate requires Rust 1.85 or newer and has no runtime or build dependencies. Its sole development dependency is exact vanilla-test 2.1.0. use node_ipc::{tcp, CodecConfig, Connection, Event}; fn main() -> node_ipc::Result<()> { let stream = tcp::connect(("127.0.0.1", 9763))?; let mut connection = Connection::new(stream, CodecConfig::fast())?; connection.send(&Event::new("app.message", "hello"))?; Ok(()) } Rust supplies TCP, UDP, Unix-domain sockets, Windows named pipes, raw bytes, and the Fast, Guarded, and Assured codecs. Applications supply their own verified TLS stream; the crate does not choose or reimplement cryptography. See the Rust engineer guide and native examples. C# The aligned C# package targets .NET 8, has no NuGet dependencies, and mirrors the JavaScript facade: IPCModule, config, of, server, serve*, connect*, event subscriptions, targeted emit, and broadcast. It supplies async TCP, TLS, UDP4/UDP6, Unix-domain sockets, Windows named pipes, Raw, Fast, Guarded, Assured, reconnect, and sync request queues. using NodeIpc; await using var ipc = new IPCModule(); ipc.config.silent = true; var client = ipc.connectToNet("service", "127.0.0.1", 9763)!; await client.waitForConnectAsync(); await client.emitAsync("app.message", new { text = "hello" }); See the C# package guide and native examples. Use ESM: import ipc from 'node-ipc'; CommonJS: const ipc = require('node-ipc').default; CommonJS loading uses Node.js 22.13+'s native require(esm) support. NPM Stats npm info : See npm trends and stats for node-ipc GitHub info : Code Coverage Info : Run npm run coverage to host a local version of the coverage report on 127.0.0.1:8080. Testing done with vanilla-test vanilla-test provides native V8 coverage for the ESM test suite without transpilation or bundling. Package details websites : GitHub.io site. Engineer documentation and tracked evidence. NPM Module. The npm page for the node-ipc module. This work is licenced via the MIT Licence. Testing npm test runs 195 Node correctness cases, native V8 coverage, both module loaders, installed-package smoke, and benchmark validation. Reports are written to coverage/node/. cargo test --manifest-path rust/node-ipc/Cargo.toml --all-targets runs the 38 Rust-native VanillaTest cases. node rust/node-ipc/interop/vanilla-test.js runs the separate two-direction Node/Rust interoperability gate. dotnet run --project csharp/node-ipc/tests/NodeIpc.Tests -c Release runs the exact C# native case inventory. node csharp/node-ipc/interop/vanilla-test.js runs the separate two-direction Node/C# interoperability gate, and pwsh -File csharp/node-ipc/package-smoke.ps1 validates the NuGet boundary. npm run test:behavioral runs the shared black-box Fast TCP transcript across all nine JavaScript, Rust, and C# server/client pairings. Seven pipelined payload-shape and ordering cases must pass before a separa
Read the full README on GitHub

What Hacker News says

29 sources
For extra irony, observe that node-ipc was previously released under the "Don't Be A Dick" license¹, only switching to MIT in late 2020². The DBAD license includes this: Being a dick includes - but is not limited to - the following instances: (...) 1c. Modifying the original work to contain hidden harmful content. That would make you a PROPER dick. By the terms of its original license, I think we can therefore assert that the author is, indeed, a proper dick. [1] http://dbad-license.org/ [2] https://github.com/RIAEvangelist/node-ipc/commit/9a1ad86d17a...
In Embedded Malicious Code in node-ipc
It looks like the node-ipc has become a target for spam issues lately[0]. This reminds me of what happened with Notepad++[1] (except that was nothing compared to what the node-ipc maintainer did.) EDIT: looks like Notepad++ also made a political statement about the crisis in Ukraine[2]. [0]: https://github.com/RIAEvangelist/node-ipc/issues?q=is%3Aissu... [1]: https://news.ycombinator.com/item?id=21400526 [2]: https://notepad-plus-plus.org/news/v833-make-apps-not-war/
In Embedded Malicious Code in node-ipc
From the article: > I don’t think this can be classed as open source anymore: > The definition of an Open Source License is quite clear: > 5. No Discrimination Against Persons or Groups The license must not discriminate against any person or group of persons. > I don’t really want to have to read through each of my dependencies and transitive dependencies licences to determine whether I am agreeing to discriminatory terms by using a library. I think the author of the article has misunderstood the definition, thus reached the wrong conclusion. The non-discrimination rule applies only to accessibility and nothing else. Simply put, you provide the same code/product to everybody, including Santa Claus and Mr Putin under the same set of condition and permissions. Adding/removing malicious code does not change the fact that the code is by
Read the rest
definition open sourced. All and all, this is not a license problem. Now, talk about node-ipc, which just got attacked by mobs (see https://github.com/RIAEvangelist/node-ipc/issues?q=is%3Aissu...). If an open source project is a scam, then it's a scamware. If an open source project is malicious, then it's a malware. Personally, as a normal human being, it is hard to keep a peace of mind after watching how the Russians fired multiple heavy rounds to kill the elderly couple who just traveling peacefully in a car down the road near a hospital. It is even harder to keep a peace of mind after watching a video recorded by a son showing how the Russians shoot and killed his father who sits in the driver's seat right beside him. I fully understand and respect the anger. However, I do agree that people need to be more mature on this even during this difficult time. Turn your project into a malware only hurts your own reputation and people who trusted you. Once the trust is gone, it might never recover. There are many ways to actually hurt those who contributed the invasion. Be constructive and accurate, or at very least don't be destructive.
In On the Weaponisation of Open Source
The maintainer, riaevangelist, appears to be breaking federal hacking laws by including the "peacenotwar" malware. They falsely claim it only shows a message on the users desktop, however if actually recursively overwrites the users files. https://github.com/RIAEvangelist/node-ipc/issues/319 The maintainer has taken to banning anyone pointing this out. I don't believe this is someone with good intentions. Riaevangelist may have had their account stolen. Either way they are clearly operating in support of Russia under a false flag, an increasingly common and complex issue. Given the supposed criminal nature of these acts GitHub and other serves must step in to remove the offending commits, releases, and maintainers. Allow someone else to fork it.
In American NGO affected by your recklessness (node-ipc vulnerability)

Showing the 15 most recent of 29 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.