A malicious npm package named 'indexed-btree' is part of an ongoing campaign that evades supply-chain defenses by hiding its payload in runtime behavior, according to BleepingComputer. Instead of relying on installation scripts, the package executes malicious code when it is used normally by an application.
This approach lets the malware slip past security checks that focus on install-time hooks and lifecycle scripts. The code remains inactive until a developer imports the package and runs the project, at which point the malicious behavior triggers.
The campaign underscores a gap in npm supply-chain monitoring: install-time scanning alone is insufficient. Developers and security teams need to treat runtime execution as a potential attack vector and review package behavior beyond the moment of installation.