npm Supply Chain Attack Hides Malware Inside Normal Package Code to Evade Detection

A new npm supply chain campaign is hiding malware inside ordinary JavaScript package code instead of using the usual preinstall or postinstall scripts. The approach allows malicious packages to appear clean during installation while activating only when developers use their functions. The campaign involves the malicious indexed-btree package,... Weiterlesen