Attackers targeting the npm ecosystem have adopted a new evasion technique that bypasses install-script detection by hiding malicious code in the package’s normal runtime behavior rather than installation hooks. The ongoing campaign targets the ‘indexed-btree’ package and represents an evolution in JavaScript supply chain attacks that exposes gaps in current defensive tools.
How the indexed-btree Campaign Evades Install-Script Monitoring
Traditional npm supply chain defenses focus on detecting malicious behavior during package installation. Security tools and manual audits typically flag packages that execute code via npm install hooks such as preinstall, postinstall, or install scripts. These hooks have been the primary vector for npm malware because they run automatically when developers add a package to their project.
The indexed-btree campaign sidesteps this detection layer by placing malicious code in the package’s normal runtime execution paths. Instead of triggering during npm install, the malicious code activates when the package is imported and used in an application. Developers who audit only install scripts or rely on tools that monitor install-time behavior will not detect this runtime malware before it executes.
What Runtime Execution Evasion Means for npm Security Tooling
Most npm security scanners and static analysis tools prioritize install-script inspection because install-time execution has been the dominant attack vector for years. These tools may parse package.json for suspicious lifecycle hooks, sandbox install scripts in isolated environments, or block packages with known-malicious install behavior.
Runtime execution evasion undermines this model. A package that appears safe during installation can carry malicious logic that only executes when the application calls specific functions or imports certain modules from the package. This delayed execution makes it harder to identify malicious packages through automated pre-installation checks.
The shift toward runtime execution also complicates developer workflows. A developer who manually reviews a new package before installation may examine its install scripts but skip the deeper code audit required to detect runtime malware. The assumption that a package without install-time hooks is low-risk no longer holds.
indexed-btree as the Target Package
The campaign specifically targets the ‘indexed-btree’ package, a JavaScript library used for indexed data structures. Attackers likely chose this package because it is a plausible dependency for data-intensive applications, making malicious versions less conspicuous when they appear in a project’s dependency tree.
npm package maintainers should be alert for typosquatted or compromised versions of indexed-btree. Organizations that have installed indexed-btree in recent weeks should investigate which version is present and remove the package if it matches indicators of the malicious campaign.
Expanding Audits Beyond Install Scripts
The indexed-btree campaign shows that supply chain attackers are adapting to current defenses. As install-script monitoring becomes more common, attackers are migrating malicious logic to runtime code paths that existing tools do not inspect as rigorously.
npm package maintainers and security teams need to expand their audit scope beyond install scripts to include runtime execution paths. This includes reviewing the code that executes when a package is imported, when its functions are called, and when it interacts with the file system, network, or other system resources during normal operation.
Runtime monitoring tools that observe package behavior during application execution can help detect this class of malware. These tools track network requests, file system access, and process spawning at runtime, flagging unexpected activity even if the package’s install phase appeared benign.
Implications for JavaScript Supply Chain Defense
The technique used in the indexed-btree campaign is not limited to this single package. Any npm package can hide malicious code in runtime execution paths, and the method is generalizable across the JavaScript ecosystem. Attackers targeting other programming language package managers — such as PyPI for Python or RubyGems for Ruby — may adopt similar runtime evasion techniques.
Defenders face a growing challenge: as automated install-time scanning becomes more effective, attackers will continue shifting toward runtime execution, dependency confusion, and other evasion methods that exploit gaps in current tooling. The industry needs runtime-aware supply chain defenses that can detect malicious behavior regardless of when it executes in the package lifecycle.
Organizations using npm should treat this campaign as a signal to revisit their package vetting processes. Auditing install scripts remains necessary, but it is no longer sufficient. Comprehensive supply chain security requires runtime monitoring, code review of critical dependencies, and layered defenses that assume some malicious packages will evade pre-installation checks.
