#1 / TODAY
Malicious npm packages evade install-script defenses at runtime
BleepingComputer reports that malicious npm packages are evading install-script defenses by operating at runtime. The source states that these packages avoid detection mechanisms built around install scripts, shifting their malicious activity to when the code executes rather than during installation. The report frames this as a technique that sidesteps defenses focused on the install phase. The source does not name specific packages, versions, or maintainers, and does not describe remediation steps or affected users.
Defenses that only inspect npm install scripts may miss malicious behavior that occurs when package code runs.
