Malicious npm packages evade install-script defenses at runtime
BLUF
Attackers are evading npm supply chain defenses by executing malicious code at runtime rather than during installation.
NEWS
A new malware campaign targeting the 'indexed-btree' package demonstrates how adversaries hide malicious payloads within normal package execution flow. This technique circumvents standard security controls that primarily monitor and block suspicious install-time scripts.
Why I Care
Organizations relying solely on install-script scanning are vulnerable to compromise, as runtime execution grants attackers access to production environments and sensitive data without triggering traditional alerts.
Next Steps
Security teams should immediately audit installed npm packages for unexpected runtime behaviors and implement runtime application self-protection (RASP) or enhanced monitoring by the end of this quarter.
Source: BleepingComputer ·