NPM Malware Campaign Achieves 6M+ Downloads by Evading Install-Script Security Controls
Executive Summary
In September 2026, security researchers discovered a sophisticated npm supply chain attack targeting the 'indexed-btree' package and nine related libraries, collectively achieving over 6 million downloads. The campaign bypassed GitHub's new npm security measures by hiding malicious code in runtime methods rather than installation scripts, allowing the malware to execute when developers called specific package functions. The malware collected system information, established command-and-control through Ethereum smart contracts, and exfiltrated data via Slack and Telegram channels while maintaining the appearance of legitimate packages.
This incident highlights the evolution of supply chain attacks as threat actors adapt to new security measures, demonstrating the critical need for runtime behavioral analysis alongside traditional install-time scanning in modern development environments.
Why This Matters Now
Supply chain attacks are rapidly evolving to bypass traditional security controls, with attackers now targeting runtime execution paths rather than installation hooks, requiring immediate updates to development security practices and tooling.
Attack Path Analysis
Attackers compromised the npm supply chain by creating malicious packages that mimicked legitimate libraries, bypassing install-time security measures by embedding malware in runtime methods. The malware executed during normal application usage, escalated privileges through system reconnaissance, established command and control via Ethereum smart contracts and messaging platforms, and exfiltrated system information while maintaining persistence through obfuscated code injection.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Threat actors published malicious npm packages including 'indexed-btree' that impersonated legitimate libraries, bypassing GitHub's new security measures by avoiding installation scripts and hiding malicious code in runtime methods like BTree.prototype.set()
MITRE ATT&CK® Techniques
Supply Chain Compromise: Compromise Software Supply Chain
Hijack Execution Flow: DLL Search Order Hijacking
Obfuscated Files or Information
Application Layer Protocol: Web Protocols
System Information Discovery
Exfiltration Over C2 Channel
Indicator Removal on Host: File Deletion
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Software Development Lifecycle Security
Control ID: 6.2.4
NYDFS 23 NYCRR 500 – Risk Assessment
Control ID: 500.08
DORA – ICT Risk Management Framework
Control ID: Article 9
CISA ZTMM 2.0 – Application Security and Code Integrity
Control ID: ZT.AL-4
NIS2 Directive – Supply Chain Security
Control ID: Article 21(2)(b)
ISO 27001 – Information and Communication Technology Supply Chain
Control ID: A.15.1.3
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Critical exposure to npm supply chain attacks targeting runtime execution, bypassing install-script defenses with malicious packages achieving millions of downloads.
Information Technology/IT
High risk from sophisticated malware using blockchain C2 infrastructure, system reconnaissance, and credential theft affecting development environments and infrastructure.
Financial Services
Severe threat from cryptocurrency wallet integration and Ethereum-based command control, enabling financial data exfiltration through compromised development supply chains.
Computer/Network Security
Direct impact on security tooling and analysis systems using npm packages, with malware designed to evade static scanners and taint-analysis tools.
Sources
- Malicious npm packages evade install-script defenses at runtimehttps://www.bleepingcomputer.com/news/security/malicious-npm-packages-evade-install-script-defenses-at-runtime/Verified
- npm BTree Malware Campaign Affects Millions of Downloads: No Need for Install Scripthttps://checkmarx.com/zero-post/npm-btree-malware-campaign-affects-millions-of-downloads-no-need-for-install-script/Verified
- GitHub announces npm security changes to tackle supply chain attackshttps://www.bleepingcomputer.com/news/security/github-announces-npm-security-changes-to-tackle-supply-chain-attacks/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely reduce the blast radius of this npm supply chain attack by constraining lateral movement between development environments and limiting outbound data exfiltration paths through segmented network access controls.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Cloud-native workload segmentation could limit the scope of compromised development environments by restricting which resources and services the infected applications can communicate with during runtime execution.
Control: Zero Trust Segmentation
Mitigation: Microsegmentation policies would likely reduce the malware's reconnaissance capabilities by limiting access to system information and preventing enumeration of adjacent network resources and infrastructure components.
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely constrain the malware's ability to spread between development workloads, CI/CD systems, and shared infrastructure by enforcing segmented communication paths between services.
Control: Multicloud Visibility & Control
Mitigation: Centralized visibility controls could detect and limit unauthorized outbound connections to external messaging platforms and blockchain networks by monitoring traffic patterns and enforcing approved communication channels.
Control: Egress Security & Policy Enforcement
Mitigation: Egress controls would likely reduce data exfiltration by blocking or limiting outbound connections to unauthorized external platforms and enforcing data loss prevention policies on sensitive system information.
While the malware could still achieve initial compromise through the npm supply chain, the overall impact would likely be reduced to individual workload segments rather than widespread infrastructure compromise.
Impact at a Glance
Affected Business Functions
- Software Development and CI/CD Pipeline
- Application Runtime Environment
- DevOps Infrastructure
- Source Code Management
Estimated downtime: 3 days
Estimated loss: N/A
System architecture details, hostnames, CPU and memory information, uptime data, development environment secrets, and potentially encrypted cryptocurrency wallet information. The malware collected system telemetry and exfiltrated data through hardcoded Slack and Telegram channels. Affected organizations with 2+ million weekly downloads of the primary package suggest widespread exposure across the JavaScript/Node.js development ecosystem.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to isolate development environments and prevent lateral movement from compromised npm packages into production systems
- • Deploy Egress Security & Policy Enforcement to block unauthorized outbound communications to Slack, Telegram, and blockchain networks from development workloads
- • Enable Multicloud Visibility & Control to detect anomalous runtime behaviors and suspicious automation patterns during package execution
- • Utilize Cloud Native Security Fabric (CNSF) for real-time inspection and distributed policy enforcement to catch runtime-activated malware that bypasses install-time scanning
- • Establish Threat Detection & Anomaly Response capabilities to baseline normal development environment behavior and alert on covert communication channels and unexpected system reconnaissance activities
