NewsCSO OnlineSME

    New npm malware finds a way around install script defenses

    Blocking suspicious install scripts may no longer be enough to mitigate threats from malicious JavaScript dependencies used in software supply-chain attacks. Security researchers at Checkmarx are warning of attackers using a malicious package called “indexed-btree” to impersonate the legitimate sorted-btree library, to spread malware hidden in the package’s normal runtime code. The campaign abandons the preinstall and postinstall scripts common in recent attacks, instead using a core package function to deliver its payload. Checkmarx said the malicious package was downloaded nearly 2 million times per week before it was flagged and removed from the registry on September 3, 2026. This was roughly 11 weeks after the first malicious version went live, according to an independent analysis by Blogspan author Alexander Baumgärtner . The discovery comes after npm introduced tighter controls around lifecycle scripts in June. Blockchain C2 combined with Slack/Telegram data theft The malicious script was embedded directly into a runtime method “BTree.prototype.set”, instead of an install hook in the package’s package.json . When the method receives a particular key value, the code launches an obfuscated first-stage loader as a detached Node.js process. Once launched, the loader fingerprints the host, collecting information including the operating system architecture, hostname, CPU, memory and uptime. The data is then exfiltrated using hardcoded Slack channel and Telegram chats. The attackers hid the command-and-control (C2) server address in a smart contract on the Sepolia Ethereum testnet blockchain. “The contract exposes getter and setter functions that the malware polls instead of requesting a plain domain,” Checkmarx researchers said. “This technique is more resilient to domain / IP takedown than traditional C2 approaches, since it uses the smart contract as a pointer to a new address whenever the old one gets taken down. Further in the chain, the malware creates cryptographic keys to establish a shared secret with a public key retrieved from the blockchain. This secret is ultimately used to unlock a second-stage payload from two encrypted chunks in the smart contract. Checkmarx did not say what the second-stage loader does, but it did point out that the malware cleans up after itself. It contains “functionality to delete the malware files and remove the trigger code from the main prototype function,” the researchers noted. Nine more packages broaden the campaign Checkmarx also identified nine other npm packages linked to the campaign, which were subsequently removed from the registry. These included ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, and sliding-score-window. Several of these packages had hundreds of thousands of downloads, while btree-core had more than 1.9 million downloads. The operators tried making the package ecosystem look legitimate, Checkmarx noted, maintaining a GitHub repository with numerous commits while keeping the malicious code itself out of the repository. The associated GitHub account too used an AI-generated profile image. Checkmarx said the campaign is ongoing and that its findings may change as the investigation develops. It shared a list of indicators of compromise (IOCs) for security teams to use in detection and monitoring. This article first appeared on InfoWorld .

    More on defenses

    Other advisories

    Other news entries

    Source: https://www.csoonline.com/article/4224400/new-npm-malware-finds-a-way-around-install-script-defenses-2.html

    ID