[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-_Ve4RfXMvdw20i3L9B7XZ9bre8f5FbCl8RWxl5r6ms":3},{"article":4,"iocs":54,"watch_terms":61,"solutions":62,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"bdfe920e-8e16-47fc-94e3-36837084a959","Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal","malicious-npm-package-indexed-btree-hid-its-loader-in-runtime-code-before-remova-9806c6","A malicious npm package named \"indexed-btree\" has been observed hiding its malicious behavior within application code rather than using lifecycle scripts, indicating that threat actors are likely shifting tactics in response to recent security controls. \"Indexed-btree is a malicious npm package mimicking the legit sorted-btree package, an ordinary B-tree\u002Findexing utility,\" Checkmarx said. \"","A malicious npm package named 'indexed-btree' mimicked a legitimate utility but hid its malware loader within application runtime code, bypassing recent npm security changes that restrict automatic execution of lifecycle scripts. The package, uploaded by 'charlessadler25', amassed millions of downloads before removal and potentially earned the attacker over €230,000 in cryptocurrency. This tactic shift highlights attackers adapting to new defenses by embedding malicious code directly into library functions.","Malicious npm package 'indexed-btree' hid malware in runtime code, bypassing new security controls.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fmalicious-npm-package-indexed-btree-hid.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjaN7aXt0PoPdZQ_VG77wkwdIyNugcdkFD6MnMvlj5LN_byw2ZrX8-gtpDld4CviuW1MOhHiElsvFtIkO9IfhBr4af-sJwM1zvR-RFICRll4G5jG4JNPX1vx4sup3omlw8uTJgro9UUfzecLMI1Whls3ihqZ9OXYJliIBjhpoodf4WI9j1lA6EUjms7x1pG\u002Fs1600\u002Frth.jpg","2026-09-22T09:38:18+00:00","2026-09-22T12:00:29.84739+00:00",9,[17,20,22,24,27,29],{"name":18,"type":19},"npm","product",{"name":21,"type":19},"indexed-btree",{"name":23,"type":19},"sorted-btree",{"name":25,"type":26},"B-tree","technology",{"name":28,"type":26},"JavaScript",{"name":30,"type":26},"smart contract","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":31,"icon":33,"name":34,"slug":35},null,"Supply Chain","supply-chain",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,57],{"type":43,"value":21,"context":56},"Malicious npm package name",{"type":58,"value":59,"context":60},"url","https:\u002F\u002Fsepolia.etherscan.io\u002F","Sepolia testnet for smart contract interaction",[18,21,23],{"controls":63,"vendors":150},[64,93,121],{"slug":65,"name":66,"problem":67,"products":68},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":53,"name":94,"problem":95,"products":96},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"slug":122,"name":123,"problem":124,"products":125},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",[],{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":165},"malicious-npm-package-hides-loader-in-runtime-code-earns-230k","Malicious npm Package Hides Loader in Runtime Code, Earns €230K","The 'indexed-btree' npm package demonstrates a sophisticated supply chain attack where malicious code was embedded directly into library runtime functions rather than lifecycle scripts, deliberately circumventing npm's newer security controls. Millions of downloads occurred before the package was detected and removed, highlighting how slow or absent code inspection of third-party dependencies creates massive exposure windows. This tactic shift — from install-time execution to runtime execution — shows attackers actively adapting to platform-level defenses, making static policy controls insufficient on their own. The financial impact (€230,000+ in cryptocurrency) underscores that supply chain attacks are highly profitable, incentivizing continued investment by threat actors. Organizations that blindly trust package download counts or registry presence as proxies for legitimacy remain critically vulnerable.",[156,157,158,159,160,161,162,163,164],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management","NIST SP 800-218 (SSDF): PW.4 – Reuse Existing, Well-Secured Software","NIST CSF DE.CM-8: Vulnerability Scans","SLSA Framework Level 2+: Source and Build Integrity","OWASP A06:2021 – Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 – Annex A 8.30: Outsourced Development","GDPR Article 32: Security of Processing (indirect risk via data exfiltration)",{}]