Malicious npm packages evade install-script defenses at runtime

An ongoing npm malware campaign uses the indexed-btree package, which attempts to impersonate the legitimate sorted-btree library and hides malicious code in normal runtime behavior rather than installation scripts. Checkmarx researchers reported that the package had reached 2 million weekly downloads.