Malicious npm packages evade install-script defenses at runtime

September 20, 2026 · BleepingComputer · Severity: HIGH

An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by hiding malicious code in a package's normal runtime behavior rather than in installation scripts.

Key Takeaways

Malicious npm packages evade install-script defenses at runtime. This high severity cybersecurity development requires attention from security teams monitoring threat intelligence sources.
Organizations should review their security posture and implement appropriate controls based on the threat intelligence in this report.
Regular monitoring of cybersecurity feeds and timely application of security updates remain critical defensive practices.