Security researchers at Checkmarx Zero have identified a malware campaign that circumvents npm's recent crackdown on lifecycle scripts, one of the package manager's key defensive measures against supply chain attacks. npm (short for Node Package Manager) is the default package manager for the Node.js JavaScript runtime environment. It helps developers install, share, and manage reusable code libraries (called packages) in their projects. The discovery signals that attackers are adapting quickly to closed loopholes, finding fresh ways to compromise developers and their projects.[1]
While npm previously tightened its handling of preinstall and postinstall scripts- the automated commands that run when a package is installed- these mechanisms were repeatedly exploited to inject malicious code onto developer machines. That restriction was widely seen as a meaningful step toward reducing supply chain risk. The malicious package identified by Checkmarx, named "btree", does not rely on preinstall or postinstall scripts at all. Instead, it executes entirely from application code once the library is called during runtime, rather than at the point of installation.
This distinction matters considerably. Many organizations have configured their security tooling to flag or block suspicious lifecycle scripts, treating installation as the primary danger point. The btree campaign shows that assumption no longer holds, as malicious behavior can now be triggered later, when a developer's code invokes the compromised library during normal use.
Perhaps most troubling is the scale involved. Despite npm's restrictions on lifecycle scripts, the affected package achieved close to 2 million weekly downloads, indicating that the underlying problem- packages harboring hidden malicious functionality- remains largely unresolved within the ecosystem.
In an expert comment, Darren Meyer, Research Advocate at Checkmarx, said the findings expose the limitations of npm's earlier reforms. "This campaign shows clearly that blocking install scripts was only ever a partial fix," he explained. "Attackers simply changed tactics, infecting targets at first library use rather than at installation," Meyer warned, adding that many security teams may be operating with a false sense of confidence. "If you're relying on checking or blocking install scripts or other lifecycle scripts to keep you safe, you're missing a risk that was always there, but will be much more prevalent now." These findings raise fresh questions about how open-source ecosystems can be secured against determined and adaptive attackers.
Lifecycle script restrictions were designed to close off one well-understood attack vector, yet this campaign demonstrates that malicious actors can simply shift their approach to runtime execution instead, achieving the same outcome through a different technical route.
For organizations that depend heavily on npm packages, and in practice this means most JavaScript projects, the report suggests that install-time scanning alone is no longer sufficient. Continuous monitoring of package behavior, including how code behaves once it is used within an application, is becoming increasingly necessary.
The nearly two million weekly downloads recorded for the affected package also illustrate how difficult it remains to detect malicious code hidden within the sprawling and rapidly changing npm registry, even when defenders believe they have addressed a known category of risk. Checkmarx's research points to an ongoing arms race between platform defenses and attacker tactics, one in which closing a single door rarely stops those determined to find another way in.
This AI-created article is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification/Tier I analysis service (RedXray) or an analysis service (CTAC). For questions, comments, or assistance, please contact the office directly at 1-844-492-7225 or feedback@redskyalliance.com
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/7855487668891299929
[1] https://www.cybersecurityintelligence.com/blog/malware-bypasses-npms-install-script-defences-9749.html
Comments