NPM Supply Chain Campaign Bypasses Install Protections

A sophisticated supply-chain attack has targeted the npm ecosystem, amassing millions of downloads through packages like 'indexed-btree' and 'btree-core'. The campaign, attributed to North Korean linked actors and the 'PolinRider' operation, demonstrates a significant shift in tradecraft by avoiding traditional 'preinstall' and 'postinstall' hooks. Instead, the malicious loader is embedded directly into common runtime functions, such as BTree.prototype.set, effectively evading npm v12's new security restrictions on lifecycle scripts.

Technically, the malware fingerprints infected hosts and exfiltrates data via Slack and Telegram. It utilizes a resilient Command and Control (C2) mechanism known as 'EtherHiding', where C2 instructions and second-stage payloads are retrieved from an Ethereum smart contract on the Sepolia testnet. This approach ensures the infrastructure is resistant to traditional domain and IP takedowns.

This campaign highlights the immediate adaptation of threat actors to platform security changes. Organizations relying on open-source libraries must look beyond install-time scanning and implement runtime behavioral analysis to detect malicious activity that triggers only when an application is actively executing.