NPM MALWARE BYPASSES INSTALL DEFENSES

Security researchers have identified an ongoing malware campaign targeting npm users that sidesteps conventional defense mechanisms. Rather than executing malicious code during package installation—where protections are typically focused—the threat actors hide payloads in the package's normal runtime operations. The 'indexed-btree' package serves as a case study in this evasion strategy. By deferring malicious activity until after installation completes, the packages avoid triggering alerts tied to install-time script execution. This approach presents a significant challenge for npm's security infrastructure, which has increasingly hardened defenses around pre- and post-install scripts. Runtime-based attacks require different detection strategies, as the malicious behavior occurs during normal package use rather than during setup. Developers are advised to audit dependencies carefully and monitor package behavior in production environments. The npm team continues evaluating additional protections against runtime-based supply chain threats.