Malicious npm Packages Bypass Install-Time Security by Hiding Malware in Runtime Code

A newly uncovered npm malware campaign demonstrates how attackers are adapting their techniques to bypass software supply chain security controls.

Security researchers at Checkmarx identified a malicious package named indexed-btree, which impersonates the legitimate sorted-btree library and has reportedly accumulated nearly two million weekly downloads.

Unlike traditional malicious npm packages that execute harmful code during installation through preinstall or postinstall scripts, indexed-btree hides its malicious loader inside the library's BTree.prototype.set() method.

The malware is triggered when the application invokes the method with a specific key value, allowing installation to complete without activating the malicious code.

What makes this attack particularly concerning?

Once activated, the malware collects system information, including the hostname, architecture, CPU, memory and uptime, and can transmit this information through Slack and Telegram.

It also uses an Ethereum smart contract on the Sepolia test network to retrieve command-and-control information and decrypt an additional payload.

This approach makes the attack more difficult to detect because malicious behaviour is embedded within ordinary application functionality rather than conventional installation scripts.

The attackers have also attempted to make their packages appear trustworthy through legitimate-looking GitHub repositories, curated developer profiles and fabricated commit histories.

Researchers identified nine additional packages associated with the operation, highlighting the broader scope of the campaign.

The reported download figures indicate distribution activity, not a confirmed number of infected devices.

What should organisations do?

Software development teams must adopt security measures that extend beyond scanning dependencies during installation.

Recommended actions:

  • Implement runtime monitoring: Detect suspicious activity originating from Node.js applications, including unexpected process execution, credential access and outbound connections.
  • Strengthen dependency verification: Validate package names, maintainers, source repositories and dependency changes before approving third-party libraries.
  • Use controlled package repositories: Restrict development and CI/CD environments to approved dependencies wherever practical.
  • Monitor network traffic: Identify unusual connections from development systems and applications to external services, including unexpected Slack, Telegram and blockchain RPC communications.
  • Protect sensitive credentials: Prevent application dependencies from accessing unnecessary cloud credentials, API keys and authentication tokens.
  • Apply least-privilege execution: Run applications and build processes with restricted permissions and limit their filesystem and network access.
  • Investigate affected environments: Organisations that installed the identified malicious packages should remove them, investigate possible execution and data exposure, rotate potentially compromised secrets and rebuild affected development environments from trusted images where necessary.

Disabling npm installation scripts remains a useful security measure, but it must be combined with dependency inspection, runtime behavioural analysis, network monitoring and strong access controls.

The Bigger Security Lesson

This campaign exposes a significant limitation in conventional software supply chain protection.

A dependency may pass installation checks, contain no suspicious lifecycle scripts and appear legitimate through its public repository, yet still execute malicious code when the application begins using it.

Security teams must therefore monitor the behaviour of third-party components throughout the entire software lifecycle, from package selection and installation to application execution.

Key takeaway: A clean installation does not guarantee a secure application. Software supply chain security must evolve from simply checking what a package contains to continuously monitoring what that package actually does when it runs.

An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by hiding malicious code in a package's normal runtime behavior rather than in installation scripts. [...]

Source: Malicious npm packages evade install-script defenses at runtime via Bleeping Computer — published 20 Sep 2026.