SECURITYQUIET
26 days ago
Malicious npm packages evade install-script defenses at runtime
SIGNALSMONITORSECURITY
What's happening
SignalsMonitor is following this as a security story. BleepingComputer is the outlet attached so far. The first report grouped here was at 20 Sept 2026, 14:11 UTC. The headline in use is “Malicious npm packages evade install-script defenses at runtime”. This note is SignalsMonitor's own briefing, not the publisher's article.
What we know
An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by hiding malicious code in a package's normal runtime behavior rather than in installation scripts. [...
BleepingComputerRead at BleepingComputer
Story timeline
Reports grouped into this story, earliest first. Exact repeats from the same outlet are collapsed.
- First reported by BleepingComputer
Malicious npm packages evade install-script defenses at runtime
Reported by 1 outlet
- BleepingComputer
- BleepingComputerMalicious npm packages evade install-script defenses at runtime