New npm malware finds a way around install script defenses

Blocking suspicious install scripts may no longer be enough to mitigate threats from malicious JavaScript dependencies used in software supply-chain attacks.

Security researchers at Checkmarx are warning of attackers using a malicious package called “indexed-btree” to impersonate the legitimate sorted-btree library, to spread malware hidden in the package’s normal runtime code.

The campaign abandons the preinstall and postinstall scripts common in recent attacks, instead using a core package function to deliver its payload. Checkmarx said the malicious package was downloaded nearly 2 million times per week before it was flagged and removed from the registry on September 3, 2026.

This was roughly 11 weeks after the first malicious version went live, according to an independent analysis by Blogspan author Alexander Baumgärtner .