New npm malware finds a way around install script defenses
Summary
Attackers are using a malicious npm package named 'indexed-btree' to impersonate a legitimate library and deliver malware. This campaign bypasses traditional defenses that rely on blocking suspicious install scripts by embedding the malicious payload within a core package runtime method. The tainted package was downloaded millions of times per week before being removed from the registry.
IFF Assessment
This article details a new and sophisticated method of malware distribution through a popular package manager, posing a significant threat to software supply chains.
Defender Context
Defenders need to be aware of evolving supply chain attack vectors that move beyond traditional install script abuse. Monitoring for unexpected behavior in package runtime code and performing deeper code analysis of dependencies are crucial. The high download volume of the malicious package highlights the widespread risk of such attacks.