Malicious npm packages evade install-script defenses at runtime

An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by ...
InfoWorld

New npm malware finds a way around install script defenses

A malicious npm package reached over 2 million weekly downloads by hiding its payload in a routine library function rather than an install script.
Cyber Security Intelligence

Malware Bypasses npm's Install Script Defences

Researchers find attackers now infect widely used package at runtime, sidestepping recent lifecycle-script restrictions entirely. chaeckmarx ## A New Evasion Technique Emerges ...
Global Security Mag

Les attaquants contournent les nouvelles protections de npm… en déplaçant le malware de l’installation à l’exécution

Les attaquants contournent les nouvelles protections de npm… en déplaçant le malware de l'installation à l'exécution Une nouvelle campagne malveillante analysée par Checkmarx Zero montre comment ...