Malicious npm packages hide after installation and strike at runtime
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Monday, September 21st, 2026.
Development teams can be compromised even when a package installation looks completely clean. In an ongoing N P M campaign, malicious code was placed inside the normal runtime behavior of the indexed-btree package instead of using installation scripts that newer defenses can block. The loader activates through a commonly used library method, but only when that method receives a specific key value. Once running, it can collect system details, obtain command information from an Ethereum smart contract, download another payload, and remove evidence when the operators decide to end the attack. This matters because install-time approval controls and static scanning may miss code that waits for an application to call it. A compromised development environment can expose source code, credentials, build systems, and downstream customers. Leaders should ensure software supply-chain controls cover package behavior after installation, not only package intake. Defenders should combine dependency review with runtime monitoring. Teams that installed affected packages should remove them, rotate development secrets, and restore compromised environments from a trusted backup.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
