Malicious npm packages evade install-script defenses at runtime
Recorded: Sept. 20, 2026, 3 p.m.
| Original | Summarized |
Malicious npm packages evade install-script defenses at runtime News Featured OpenAI details more cases of AI agents taking unauthorized actions Brevo supply-chain attack injected ClickFix scripts on customer sites Cisco warns of max severity ISE zero-day exploited in attacks Microsoft shares workaround for Windows domain login issues Malicious npm packages evade install-script defenses at runtime Own 88 hours of AI & cybersecurity training for just $29.99 Researchers escape OpenAI Codex sandbox to run commands on host BragJack attacks hijack AI browser agents through malicious extensions Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityMalicious npm packages evade install-script defenses at runtime Malicious npm packages evade install-script defenses at runtime By Bill Toulas September 20, 2026 An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by hiding malicious code in a package's normal runtime behavior rather than in installation scripts. The malicious runtime triggerSource: Checkmarx Fabricated commit historySource: Checkmarx Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Related Articles: GitHub Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment You may also like: Upcoming Webinar Popular Stories Cisco warns of max severity ISE zero-day exploited in attacks Microsoft shares workaround for Windows domain login issues Brevo supply-chain attack injected ClickFix scripts on customer sites Sponsor Posts Overdue a password health-check? Audit your Active Directory for free Patch automation needs more than speed. Action1 brings control into every stage of deployment. Automate Onboarding and Access Reviews with No-Code IGA: See how it works Watch a working exploit hit live controls and see exactly what blocks, detects, or misses Find out how long recovery really takes — and what it costs. Read the 2025 BCDR Report. Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
An ongoing campaign targeting the npm ecosystem has demonstrated how threat actors can circumvent supply chain defenses by embedding malicious code within a package's normal runtime behavior rather than exploiting installation scripts. Researchers at Checkmarx identified this method in the 'indexed-btree' package, which attempted to impersonate the legitimate 'sorted-btree' library and had amassed two million weekly downloads. This activity was linked to attackers who reportedly generated significant profit, with reports noting they held 109 ETH in a wallet, although the source of these funds was not specified as cryptocurrency theft. To evade recently implemented npm security measures—which aim to block malicious code within dependency lifecycle scripts like preinstall, install, and postinstall, and prevent unauthorized dependency fetching—the malicious package concealed its malicious loader within the BTree.prototype.set() method. This method is a frequently called function, meaning the malicious code executes at runtime whenever an application interacts with it using a specific key value. This execution triggers the loading of a file named sharedLoad.min.js, which contains the initial stage of the malware payload, allowing it to bypass standard taint analysis tools and most static scanners. Once executed, the malware’s function is to collect comprehensive system details, including the architecture, hostname, CPU information, memory statistics, and uptime of the host system. This gathered information is then exfiltrated by forwarding it through hardcoded channels to Slack and Telegram. Furthermore, the malicious code engages in command-and-control activities by polling an Ethereum smart contract on the Sepolia test network to retrieve further instructions. The malware utilizes X25519 key exchange to derive an AES key, which is then used to decrypt a second-stage payload stored within the smart contract. The threat actors possess a mechanism to erase their presence by deleting files and removing the malicious trigger from the package code when they conclude the operation. The sophistication of the threat actors is further illustrated by their efforts to establish credibility, which included creating a legitimate-looking GitHub repository, populating its commit history, and curating the developer account associated with the package. Checkmarx also uncovered nine additional npm packages linked to this same operation that displayed substantial download numbers, including ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, and sliding-score-window. As a result of these findings, security experts advise that relying solely on installation-time scanning is insufficient for detecting supply chain threats. There is an increased emphasis on employing runtime behavioral analysis to monitor application execution for suspicious activities. Developers who have introduced packages like indexed-btree or any of the other identified malicious packages are strongly recommended to rotate all secrets and restore their development environment from a secure backup to mitigate potential exposure. |