[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBKr86LEMzEdnYDzFIYpTnAjxT7MMdD2VUNRSgkiNmKI":3},{"article":4,"iocs":55},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":32,"category":33,"article_tags":37},"827fb58d-250f-4682-bc4e-f38edb4c971a","Malicious npm packages evade install-script defenses at runtime","malicious-npm-packages-evade-install-script-defenses-at-runtime-20c921","An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by hiding malicious code in a package's normal runtime behavior rather than in installation scripts. [...]","A new npm malware campaign uses the 'indexed-btree' package to bypass security measures by embedding malicious code within the package's runtime functions, rather than installation scripts. This technique allows it to evade detection by npm's latest security features. The malware collects system information, exfiltrates it via Slack and Telegram, and uses an Ethereum smart contract for C2 communication, with the attackers potentially amassing significant profits.","Malicious npm package 'indexed-btree' evades defenses by hiding malware in runtime behavior.","Malicious npm packages evade install-script defenses at runtime By Bill Toulas September 20, 2026 10:11 AM 0 An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by hiding malicious code in a package's normal runtime behavior rather than in installation scripts. The package, spotted by Checkmarx researchers, attempts to impersonate the legitimate 'sorted-btree' library and has already amassed 2 million weekly downloads. The campaign may also have generated significant profits for the attackers, who, according to Checkmarx, use a wallet holding 109 ETH. However, the report does not say those funds came from cryptocurrency theft. Bypassing latest security measures In June 2026, GitHub announced a set of npm security measures designed to help prevent supply chain attacks that have shaken open-source ecosystems repeatedly since late 2025. One key security measure is to block dependency lifecycle scripts such as 'preinstall', 'install ', and 'postinstall,' unless explicitly approved. Other measures prevent npm from automatically retrieving dependencies from Git repositories or remote URLs without permission. The malicious indexed-btree package sidesteps these protections by avoiding installation scripts and instead hiding its loader in the package's BTree.prototype.set() method, which executes at runtime when the application calls it with a specific key value. As a result, installation appears clean and triggers none of npm v12's approval mechanisms. \"The malware loader hides inside the library's own BTree.prototype.set method, which is the main function that every user would call constantly,\" explains Checkmarx. \"This triggers the sharedLoad.min.js, which contains the obfuscated first stage of the malware. This is a well-built way to sneak past standard taint-analysis tools and most static scanners.\" The malicious runtime triggerSource: Checkmarx Once the malware is executed, it can collect system details, including architecture, hostname, CPU, memory, and uptime, and exfiltrate the information through hardcoded Slack and Telegram channels. The malware also polls an Ethereum smart contract on the Sepolia test network for command-and-control (C2) information. It uses X25519 key exchange to derive an AES key and decrypt a second-stage payload stored in the contract. When the operators choose to end the attack, the malware can delete its files and remove the malicious trigger from the package code to wipe its traces. The researchers note that the threat actors have gone to great lengths to make the project appear legitimate, including building a legitimate-looking GitHub repository, populating its commit history, and curating the developer account. Fabricated commit historySource: Checkmarx Checkmarx also discovered nine additional npm packages linked to the same operation, which it has now removed from npm. Those also achieved significant download numbers, as seen here: ordered-kv-index (448,184 downloads) btree-leaderboard (493,685 downloads) priority-slot-queue (402,860 downloads) btree-range-store (468,092 downloads) btree-core (1,951,274 downloads) btree-time-index (425,312 downloads) btree-lru-cache (372,185 downloads) neighbor-key-map (366,019 downloads) sliding-score-window (448,024 downloads) Developers are advised not to rely on install-time scanning alone, and to also employ runtime behavioral analysis. Those who installed indexed-btree or any of the above-listed packages should rotate all secrets and restore their development environment from a safe backup. Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Save your seat Related Articles: Fake LastPass Authenticator GitHub repos push new Rapuncel infostealerAmazon links Debug, Chalk NPM supply-chain attacks to North Korean hackersFakeGit campaign uses 7,600 GitHub repos to push SmartLoader malwareNew RatHat Android malware uses AI to automate device controlIranian hackers use CHOSEN BRICK Windows malware to spy on targets","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmalicious-npm-packages-evade-install-script-defenses-at-runtime\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F05\u002F15\u002Fnpm.jpg","2026-09-20T14:11:21+00:00","2026-09-20T16:00:08.197532+00:00",9,[18,21,23,26,28,30],{"name":19,"type":20},"indexed-btree","product",{"name":22,"type":20},"sorted-btree",{"name":24,"type":25},"npm","technology",{"name":27,"type":25},"BTree.prototype.set",{"name":29,"type":25},"X25519",{"name":31,"type":25},"AES","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":32,"icon":34,"name":35,"slug":36},null,"Supply Chain","supply-chain",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,58,62,64,67,69,71,73,75,77,79,81],{"type":44,"value":19,"context":57},"Malicious npm package impersonating 'sorted-btree'.",{"type":59,"value":60,"context":61},"domain","slack.com","Exfiltration channel for system information.",{"type":59,"value":63,"context":61},"telegram.org",{"type":44,"value":65,"context":66},"ordered-kv-index","Additional malicious npm package linked to the operation.",{"type":44,"value":68,"context":66},"btree-leaderboard",{"type":44,"value":70,"context":66},"priority-slot-queue",{"type":44,"value":72,"context":66},"btree-range-store",{"type":44,"value":74,"context":66},"btree-core",{"type":44,"value":76,"context":66},"btree-time-index",{"type":44,"value":78,"context":66},"btree-lru-cache",{"type":44,"value":80,"context":66},"neighbor-key-map",{"type":44,"value":82,"context":66},"sliding-score-window"]