Malicious npm Package indexed-btree Hides Payload in Runtime Code

Security researchers uncovered a malicious npm package named indexed-btree masquerading as a legitimate indexing utility. Instead of relying on traditional installation lifecycle scripts, the malware hid its malicious behavior directly within the application’s runtime code to bypass standard security controls, highlighting an evolving tactic among supply-chain threat actors to evade detection.