Malicious npm package hides payload in runtime, not install scripts
A new npm campaign shows attackers can bypass supply-chain checks by triggering malicious behavior only when the package runs, not during installation.
A malicious npm package named 'indexed-btree' is part of an ongoing campaign that evades supply-chain defenses by hiding its payload in runtime behavior, according to BleepingComputer. Instead of relying on installation scripts, the package executes malicious code when it is used normally by an application.
This approach lets the malware slip past security checks that focus on install-time hooks and lifecycle scripts. The code remains inactive until a developer imports the package and runs the project, at which point the malicious behavior triggers.
The campaign underscores a gap in npm supply-chain monitoring: install-time scanning alone is insufficient. Developers and security teams need to treat runtime execution as a potential attack vector and review package behavior beyond the moment of installation.
More in Security & Privacy
WordPress Click2Shell CSRF Flaw Could Let Attackers Run PHP Code
A newly disclosed cross-site request forgery vulnerability in WordPress Core, with a public proof-of-concept, can let attackers execute PHP on the server.
Film Torrents Carry New Malware, Victims Found in Kenya and Uganda
Cybercriminals are using popular movie torrents to distribute fresh malware, with confirmed infections in East Africa.
CrowdSec Breach: TanStack npm Attack Exposed 170 Private Repos
CrowdSec says an attacker used a former employee's still-active GitHub access to copy 170 private repositories, tracing the intrusion to the TanStack npm attack.
CISA Adds Three Exploited Linux Kernel Flaws to KEV Catalog
The agency's move signals active attacks and pressures federal agencies to patch quickly.