Malicious npm packages evade install-script defenses at runtime

An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by hiding malicious code in a package's normal runtime behavior rather than in installation scri…. This evolving threat vector demonstrates a significant challenge for software supply chain security, as standard defenses that scrutinize pre-installation scripts may be ineffective.

https://meta-news.info/ver/m…