npm v12

Malicious npm packages evade install-script defenses at runtime

Checkmarx identified an ongoing npm supply-chain malware campaign centered on the malicious "indexed-btree" package, which impersonates "sorted-btree" and evades install-script pr…

Sep 20, 2026