Malicious npm packages evade install-script defenses at runtime
-
An ongoing npm malware campaign involving the package indexed-btree is demonstrating how attackers can sidestep common supply chain defenses by embedding malicious behavior in a package's normal runtime execution instead of its install scripts. Because many security tools focus on detecting suspicious preinstall, install, and postinstall hooks, this approach allows the malicious code to evade those checks entirely and activate only when the package is actually used.
The campaign highlights a broader gap in how npm packages are vetted. Install-script analysis, while useful, does not cover what a package does after it has been loaded and executed by an application. Malicious logic placed in runtime paths can remain dormant during installation and trigger under conditions the attacker controls.
Key points from the report:
- The campaign involves the indexed-btree package.
- Malicious code is hidden in normal runtime behavior rather than in install scripts.
- This technique bypasses defenses that rely primarily on install-script inspection.
- The activity is described as ongoing.
Defenders should consider going beyond install-script scanning by monitoring package runtime behavior, reviewing dependency changes, and applying least-privilege controls around what installed packages can access during execution.
Source: Unknown
Does your organization inspect npm packages at runtime, or does your vetting stop at install-script analysis?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login