Malicious npm Package 'indexed-btree' Hides Payload in Runtime Code, Not Install Scripts

What happened

BleepingComputer reports an ongoing npm supply chain campaign centered on a package called indexed-btree. According to the report, the malware evades common supply chain defenses by embedding malicious logic in the package's normal runtime behavior rather than in preinstall/postinstall scripts, which is where most automated scanners and registry-side protections focus their attention.

Why it matters

Many npm security tools — registry-side scanners, CI gates, and developer tooling — are tuned to flag suspicious install scripts, since that has historically been the most common injection point for npm malware. A package that defers its malicious behavior to runtime, after a clean install, can slip past those checks and only reveal itself once the code actually executes in an application or build pipeline. Any organization pulling this or similarly structured packages into Node.js projects, directly or as a transitive dependency, is potentially exposed.

What defenders should do now

• Check dependency trees (including transitive dependencies) for the indexed-btree package and remove or pin away from it if present.
• Don't rely solely on install-script analysis for supply chain vetting — extend review/monitoring to runtime behavior of newly added or unusually-behaving npm packages.
• Watch for anomalous outbound network connections, file system access, or process execution originating from Node.js application or build processes shortly after dependency installs or updates.
• Consider runtime application self-protection (RASP), egress monitoring, or sandboxed CI/build environments for dependency installation and first-run execution.
• Audit CI/CD logs for unexpected behavior in build jobs that recently added or updated npm dependencies.

Developing story

This is based on a single vendor report and details may evolve as more of the campaign is analyzed. There is no associated CVE for this item. For the original reporting, see BleepingComputer's coverage.