Checkmarx just disclosed an npm supply chain attack where a malicious package, indexed-btree, mimicked a legitimate B-tree utility and reached 2 million weekly downloads before detection, hiding its payload in the package’s prototype method and using a fabricated GitHub commit history to look credible. Related packages in the same campaign topped 5 million downloads before removal.
Checkmarx has a post about the incident here: Update: Ongoing Checkmarx Supply Chain Security Incident
Justin Beals, CEO & Founder, Strike Graph, an AI-native GRC and compliance automation platform had this to say:
“This campaign worked because the attacker understood what security teams actually check. They didn’t need a fast-spreading package that trips alarms. They built a GitHub history with real-looking commits and let the package earn trust the slow way, then hid the payload inside a prototype method nobody audits line by line. Two million weekly downloads means this package sat inside production code at a huge number of companies, and none of their vendor questionnaires or install-time scanners caught it, because the malicious behavior only fires when the code actually runs.
This is the same failure I keep coming back to with third-party risk. We ask vendors to attest that their code is safe and call that due diligence. A GitHub repo with a clean commit history is exactly the kind of thing that passes an attestation. It doesn’t tell you what the code does when it executes. Teams need to know what every dependency in their stack is actually doing at runtime, not just whether the maintainer looks credible on paper.
Package registries are going to keep getting hit this way because the economics work. A threat actor spends a few months building trust and walks away with hundreds of thousands of dollars and access to millions of environments. Until organizations start validating dependency behavior continuously instead of trusting a package because it looks established, this pattern repeats.”
You only are secure as those you work with. This is not a new thing that I’ve said. The question is, when will organizations get a clue about this and take the right action to make this less of a threat.
Related
This entry was posted on September 22, 2026 at 4:32 pm and is filed under Commentary with tags Hacked. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
npm Supply chain attack built trust before delivering malware
Checkmarx just disclosed an npm supply chain attack where a malicious package, indexed-btree, mimicked a legitimate B-tree utility and reached 2 million weekly downloads before detection, hiding its payload in the package’s prototype method and using a fabricated GitHub commit history to look credible. Related packages in the same campaign topped 5 million downloads before removal.
Checkmarx has a post about the incident here: Update: Ongoing Checkmarx Supply Chain Security Incident
Justin Beals, CEO & Founder, Strike Graph, an AI-native GRC and compliance automation platform had this to say:
“This campaign worked because the attacker understood what security teams actually check. They didn’t need a fast-spreading package that trips alarms. They built a GitHub history with real-looking commits and let the package earn trust the slow way, then hid the payload inside a prototype method nobody audits line by line. Two million weekly downloads means this package sat inside production code at a huge number of companies, and none of their vendor questionnaires or install-time scanners caught it, because the malicious behavior only fires when the code actually runs.
This is the same failure I keep coming back to with third-party risk. We ask vendors to attest that their code is safe and call that due diligence. A GitHub repo with a clean commit history is exactly the kind of thing that passes an attestation. It doesn’t tell you what the code does when it executes. Teams need to know what every dependency in their stack is actually doing at runtime, not just whether the maintainer looks credible on paper.
Package registries are going to keep getting hit this way because the economics work. A threat actor spends a few months building trust and walks away with hundreds of thousands of dollars and access to millions of environments. Until organizations start validating dependency behavior continuously instead of trusting a package because it looks established, this pattern repeats.”
You only are secure as those you work with. This is not a new thing that I’ve said. The question is, when will organizations get a clue about this and take the right action to make this less of a threat.
Share this:
Like this:
Related
This entry was posted on September 22, 2026 at 4:32 pm and is filed under Commentary with tags Hacked. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.