Malicious npm packages evade install-script defenses at runtime
Summary
A new npm malware campaign utilizes the 'indexed-btree' package to evade defenses. Threat actors are hiding malicious code within the package's runtime behavior, bypassing traditional defenses that focus on installation scripts.
IFF Assessment
FOE
This campaign demonstrates a new evasion technique for malware delivered via software supply chains, posing a direct threat to developers and organizations relying on npm packages.
Defender Context
Defenders should be aware of this evolving threat to software supply chains, where malicious code can be hidden in package runtime behavior rather than during installation. This requires increased scrutiny of package dependencies and runtime monitoring for suspicious activity.