[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"focus:malicious-npm-packages-evade-install-script-defenses-at-runtime-muc7nz2j":3},{"item":4},{"id":5,"title":6,"slug":7,"summary":8,"severity":9,"category":10,"cve_ids":11,"affected_products":12,"action_required":15,"article_ids":16,"ioc_summary":18,"source_urls":19,"status":21,"expires_at":22,"created_at":23,"updated_at":24,"articles":25},"e6b6fa7d-a3d9-477f-8899-2a62ea8952c8","Malicious npm packages evade install-script defenses at runtime","malicious-npm-packages-evade-install-script-defenses-at-runtime-muc7nz2j","Threat actors are distributing malware via npm packages that bypass install-script detection by executing malicious code at runtime instead. The 'indexed-btree' package and likely others in this campaign exfiltrate system data via Slack\u002FTelegram and use Ethereum smart contracts for C2. Any developer or pipeline using compromised npm packages can be backdoored.","critical","advisory",[],[13,14],"indexed-btree","sorted-btree","Audit npm package dependencies immediately for 'indexed-btree' and similar suspicious packages. Review npm audit logs for installs in the past 90 days. Block execution of unknown npm packages in build pipelines and apply strict package verification policies going forward.",[17],"827fb58d-250f-4682-bc4e-f38edb4c971a",null,[20],"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmalicious-npm-packages-evade-install-script-defenses-at-runtime\u002F","active","2026-09-24T05:05:44.719+00:00","2026-09-22T05:05:50.257133+00:00","2026-09-22T05:06:21.137959+00:00",[26],{"id":17,"title":6,"url":20}]