npm Malware Hides in Runtime Code to Slip Past Install‑Script Defenses

A newly uncovered campaign targeting the Node.js package manager npm is leveraging the "indexed-btree" module to sidestep conventional supply‑chain defenses that focus on installation scripts. Security researchers observed that the malicious payload activates only during normal execution of the package, rather than during the install phase that most security tools monitor.

The "indexed-btree" package, which appears to provide a data‑structure utility, was uploaded to the public npm registry and quickly gained traction among developers. While its source code contains no overtly suspicious install scripts, hidden logic embedded in the runtime functions triggers a download of additional malicious components when the library is invoked by an application.

This technique marks a shift from earlier npm attacks that relied on post‑install scripts to gain footholds. By moving the harmful code to the execution path, threat actors exploit a blind spot in many automated scanning solutions that primarily analyze the "install" lifecycle. The approach also complicates manual code reviews, as the malicious behavior can be concealed behind seemingly benign functions.

Supply‑chain security experts note that npm’s open ecosystem, which encourages rapid sharing of small modules, inherently increases exposure to such threats. The sheer volume of packages—over two million at the time of reporting—makes comprehensive vetting a daunting task. Traditional defenses, including npm’s audit feature and third‑party scanning services, have been effective against known vulnerabilities but are less suited to detect code that only activates at runtime.

Researchers who first reported the issue to BleepingComputer recommend a multi‑layered response: developers should audit dependencies, employ runtime monitoring tools, and consider lock‑file integrity checks. npm has responded by flagging the "indexed-btree" package and issuing guidance on how to remove it from affected projects. The incident underscores the need for the community to adopt behavioral analysis alongside static code reviews.

Looking ahead, security teams are expected to enhance detection capabilities by incorporating sandboxed execution of packages and by sharing threat intelligence about anomalous runtime patterns. As attackers refine their tactics, the npm ecosystem will likely see increased emphasis on runtime security controls to protect the vast number of applications that depend on third‑party JavaScript modules.