MalwarePublished 20 Sep 2026

Malicious npm packages evade install-script defenses at runtime

Source Bleeping Computer

Description

A malware campaign involving the npm package 'indexed-btree' demonstrates how attackers evade traditional supply chain defenses by embedding malicious code in the package's runtime behavior instead of installation scripts. This technique allows the malware to bypass install-time security checks and execute malicious actions during normal package usage.

Impact

This evasion technique undermines supply chain security measures that rely on detecting malicious install scripts, potentially allowing malware to persist undetected in development environments and production systems that use the compromised package. The runtime-based malicious behavior can lead to unauthorized actions depending on the payload, though specific impacts are not detailed in the provided information.

Defensive guidance

Users should review the vendor advisory or npm security notices for updates. Until then, exercising caution when including or updating packages from untrusted sources is advised. Monitoring for unusual runtime behavior related to the 'indexed-btree' package may help detect exploitation attempts.

Summary

The ongoing npm malware campaign uses the 'indexed-btree' package to bypass supply chain defenses that focus on install scripts. Instead of placing malicious code in installation scripts, threat actors hide it within the package's runtime operations, making detection more difficult. This approach leverages the normal behavior of the package to execute malicious payloads, circumventing defenses that monitor install-time activities.

References

bleepingcomputer.com/news/security/malicious-npm-packages-evade-install-script-defenses-at-runtime/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 20 Sep 2026, 14:16 UTC

References

Community reviews

Related threats