Malicious NPM packages bypass the installation script defenses at runtime
An ongoing NPM malware campaign using the indexed-btree package shows how threat actors are evading supply chain defenses by hiding malicious code in the normal runtime behavior of a package rather than in installation scripts. The package discovered by Checkmarx researchers attempts to mimic the legitimate sorted-btree library and has already been downloaded 2 million … Read more