<![CDATA[Malicious npm packages evade install-script defenses at runtime]]>An ongoing npm malware campaign involving the package indexed-btree is demonstrating how attackers can sidestep common supply chain defenses by embedding malicious behavior in a package's normal runtime execution instead of its install scripts. Because many security tools focus on detecting suspicious preinstall, install, and postinstall hooks, this approach allows the malicious code to evade those checks entirely and activate only when the package is actually used.

The campaign highlights a broader gap in how npm packages are vetted. Install-script analysis, while useful, does not cover what a package does after it has been loaded and executed by an application. Malicious logic placed in runtime paths can remain dormant during installation and trigger under conditions the attacker controls.

Key points from the report:

  • The campaign involves the indexed-btree package.
  • Malicious code is hidden in normal runtime behavior rather than in install scripts.
  • This technique bypasses defenses that rely primarily on install-script inspection.
  • The activity is described as ongoing.

Defenders should consider going beyond install-script scanning by monitoring package runtime behavior, reviewing dependency changes, and applying least-privilege controls around what installed packages can access during execution.

Source: Unknown

Does your organization inspect npm packages at runtime, or does your vetting stop at install-script analysis?

]]>https://xploitlk.com/topic/403/malicious-npm-packages-evade-install-script-defenses-at-runtimeRSS for NodeTue, 27 Oct 2026 08:51:26 GMTSun, 20 Sep 2026 14:30:24 GMT60