MALICIOUS NPM PACKAGES EVADE INSTALL-SCRIPT DEFENSES AT RUNTIME

Summary from the TLDR InfoSec newsletter

The 'indexed-btree' npm package, which impersonates 'sorted-btree' and pulls 2 million weekly downloads, hid its loader in the BTree.prototype.set() method to bypass npm v12's install-script approvals.