Malicious npm packages evade install-script defenses at runtime
BleepingComputer reports that malicious npm packages are evading install-script defenses at runtime. According to the source, the packages avoid defenses that focus on install scripts, with the malicious behavior occurring at runtime instead of during installation. This means the activity is not caught by protections aimed at the install phase, which is where such defenses are typically applied. The source does not identify specific package names, versions, maintainers, or the number of packages involved. It also does not describe how the runtime activity is carried out, what the packages do once executing, or which users or projects are affected. No remediation steps, detection guidance, or timeline are provided in the source text. The report is limited to the observation that install-script defenses are being evaded because the malicious behavior happens at runtime.
Defenses that only inspect npm install scripts may miss malicious behavior that occurs when package code runs.