Malicious npm Packages Evade Install-Script Defenses at Runtime

A ongoing npm malware campaign has been documented by BleepingComputer, involving packages such as 'indexed-btree' that bypass conventional supply chain defenses. Rather than embedding malicious payloads in install scripts—which are commonly monitored by security tools—the threat actors have designed the malicious code to execute during the package's normal runtime behavior. This approach allows the malware to evade defenses that specifically audit installation hooks and scripts. Packages exhibiting this runtime evasion technique have been found in the npm registry, and their use could lead to compromise of developer systems and any downstream applications that depend on them. The exact scope of the campaign, the full list of affected packages, and specific technical details of the malicious payload remain limited based on initial reporting. Security authorities recommend that developers audit their dependencies, remove any suspicious packages, and monitor for official advisories or updates from npm regarding this campaign.