NPM Malware Campaign Achieves 6M+ Downloads by Evading Install-Script Security Controls
In September 2026, security researchers discovered a sophisticated npm supply chain attack targeting the 'indexed-btree' package and nine related libraries, collectively achieving over 6 million downloads. The campaign bypassed GitHub's new npm security measures by hiding malicious code in runtime methods rather than installation scripts, allowing the malware to execute when developers called specific package functions. The malware collected system information, established command-and-control through Ethereum smart contracts, and exfiltrated data via Slack and Telegram channels while maintaining the appearance of legitimate packages. This incident highlights the evolution of supply chain attacks as threat actors adapt to new security measures, demonstrating the critical need for runtime behavioral analysis alongside traditional install-time scanning in modern development environments.
Kill Chain
