Tag

#runtime-evasion

1 story tagged runtime-evasion.

Bar chart of weekly downloads across ten malicious npm packages in the indexed-btree campaign. indexed-btree leads at 2,000,000, btree-core at 1,951,274, btree-leaderboard at 493,685, btree-range-store at 468,092, ordered-kv-index at 448,184, sliding-score-window at 448,024, btree-time-index at 425,312, priority-slot-queue at 402,860, btree-lru-cache at 372,185, neighbor-key-map at 366,019. Combined total approximately 7 million downloads.

npm supply chain attack evades install defenses at runtime

An npm supply chain attack hides malware in runtime methods, bypassing npm v12 install-script blocks. Ten packages and 7 million downloads are affected.

Lars Cornelissen · Sep 21, 2026