Malicious npm packages evade install-script defenses at runtime

Threat actors are distributing malware via npm packages that bypass install-script detection by executing malicious code at runtime instead. The 'indexed-btree' package and likely others in this campaign exfiltrate system data via Slack/Telegram and use Ethereum smart contracts for C2. Any developer or pipeline using compromised npm packages can be backdoored.