As cited
Copy frozen at (site build).
threat intel
Malicious npm packages evade install-script defenses at runtime
An ongoing malware campaign involving the npm package 'indexed-btree' demonstrates how threat actors conceal malicious code in runtime behavior rather than installation scripts to circumvent supply chain protections. The campaign exploits the gap between when a package is installed and when its code actually executes, allowing obfuscated payloads to evade automated detection at setup time.
Why it matters: JavaScript developers and DevSecOps teams need to monitor runtime behavior of dependencies beyond installation phase, as traditional install-script defenses do not catch code executed after a package is imported into an application.
- Source published
- First seen by Cybersecurity Tracker