New npm malware finds a way around install script defenses

Blocking suspicious install scripts may no longer be enough to mitigate threats from malicious JavaScript dependencies used in software supply-chain attacks. Security researchers at Checkmarx are warning of attackers using a malicious package called “indexed-btree” to impersonate the legitimate sorted-btree library, to spread malware hidden in the package’s normal runtime code. The campaign abandons the preinstall and postinstall scripts common in recent attacks, instead using a core package fun