Malicious Npm Package Evades New Install-Time Security Controls
The indexed-btree package hid malware in runtime code, bypassing npm's latest restrictions on install scripts.
Key points
- Malicious npm package indexed-btree hid malware in runtime code to bypass new install-script restrictions.
- The campaign generated roughly 230,933 euros in cryptocurrency for the threat actor before removal.
- Security experts recommend adding runtime behavior analysis to detect threats that evade install-time scans.
Threat actors are adapting to recent security upgrades in the JavaScript ecosystem by embedding malicious code directly into application logic. A fake npm package named indexed-btree avoided traditional installation hooks, instead executing harmful payloads only when the software was actively used by developers.
This shift in tactics allows attackers to bypass the new safeguards introduced in npm version 12. By moving the attack vector from setup phases to runtime execution, the malware remained hidden from standard install-time scans that previously blocked such supply chain compromises.
Hidden loader evades standard detection
The package mimicked a legitimate data structure tool to gain trust. Inside a common method for updating data, the code triggered a hidden script that collected system information. This data was then sent to external communication channels controlled by the attackers.
The malware used a technique to retrieve additional encrypted code from a blockchain test network. Once assembled, the payload performed its malicious actions and then deleted its own traces to avoid detection. This self-cleaning behavior makes forensic analysis more difficult for security teams.
Financial motive behind the campaign
According to The Hacker News, the operation generated significant illicit profits for the threat actor. Statistics indicate the package was downloaded millions of times in a short period before it was removed from the registry. The estimated earnings from this activity reached approximately 230,933 euros in cryptocurrency.
The package was uploaded in June 2026 by a user with a suspicious handle. It was part of a larger group of similar packages that have since been taken down. This coordinated effort suggests a well-organized group targeting software supply chains for financial gain.
Need for layered security controls
Security experts warn that blocking install scripts is no longer sufficient for protection. Since attackers can move malicious code into standard application functions, defenders must monitor behavior during execution. Relying solely on pre-install checks leaves a gap that can be exploited by evolving threats.
Developers are advised to implement runtime behavior analysis to detect anomalies. This approach helps identify suspicious activity even when the code appears legitimate at first glance. A multi-layered strategy is essential to catch these adaptive attacks before they cause significant damage.
