Malicious npm Packages Evade Install-Script Defenses at Runtime: Detection and Hardening Guide

---
title: Node.js Process Spawning Shell or Reconnaissance Commands
id: 8c2e4a71-3f5b-4c9d-b6e1-7a2f3d4c5b6a
status: experimental
description: Detects node processes spawning shells, download cradles, or reconnaissance commands — a hallmark of runtime npm supply-chain payloads executing after module import.
references:
  - https://www.bleepingcomputer.com/news/security/malicious-npm-packages-evade-install-script-defenses-at-runtime/
  - https://attack.mitre.org/techniques/T1195/002/
  - https://attack.mitre.org/techniques/T1059/007/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1195.002
  - attack.t1059.007
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.exe'
      - '\npm.cmd'
      - '\yarn.cmd'
      - '\pnpm.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\curl.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Build tooling that legitimately shells out (node-gyp, some test harnesses) — tune by build host
level: high
---
title: Node.js Process Accessing Credential Files
id: 3d7b1f42-8a9c-4e2d-9f5b-6c1a2e3d4b5c
status: experimental
description: Detects node processes reading credential-bearing files such as .npmrc, AWS credentials, or .env files — consistent with secret harvesting by malicious npm packages at runtime.
references:
  - https://www.bleepingcomputer.com/news/security/malicious-npm-packages-evade-install-script-defenses-at-runtime/
  - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.t1195.002
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\node.exe'
      - '\npm.exe'
  selection_target:
    TargetFilename|contains:
      - '\.npmrc'
      - '\.aws\credentials'
      - '\.config\gcloud\'
      - '\.ssh\id_'
    TargetFilename|endswith:
      - '\.env'
      - '\.env.local'
      - '\.env.production'
  condition: selection_image and selection_target
falsepositives:
  - Legitimate build/deploy scripts reading .env configuration — baseline per build agent and alert on outliers
level: high
---
title: Node.js Outbound Network Connection to Rare External Destination
id: 5e1c9d83-2b4f-4a6e-8c7d-9e0f1a2b3c4d
status: experimental
description: Detects node processes establishing outbound connections to non-registry destinations. Runtime npm payloads frequently beacon or exfiltrate environment variables shortly after module load.
references:
  - https://www.bleepingcomputer.com/news/security/malicious-npm-packages-evade-install-script-defenses-at-runtime/
  - https://attack.mitre.org/techniques/T1071/001/
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.exfiltration
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\node.exe'
      - '\npm.exe'
      - '\npm.cmd'
    Initiated: 'true'
  filter_registries:
    DestinationHostname|contains:
      - 'npmjs.org'
      - 'npmjs.com'
      - 'yarnpkg.com'
      - 'github.com'
      - 'registry.npmmirror.com'
  filter_local:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
      - '127.'
  condition: selection and not filter_registries and not filter_local
falsepositives:
  - Applications legitimately calling external APIs — this rule is best deployed on CI/CD runners and build agents, where node should rarely phone arbitrary hosts
level: medium

// Hunt: Node/npm processes spawning shells or download tools across Windows and Linux endpoints
// Covers runtime npm supply-chain payload execution after module import.
// Deploy broadly; tune KnownGoodParents per build fleet.
let KnownGoodParents = dynamic(["node", "npm", "npm.cmd", "yarn", "pnpm", "node.exe"]);
union isfuzzy=true
(DeviceProcessEvents
 | where InitiatingProcessFileName in~ (KnownGoodParents)
 | where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","curl.exe","wscript.exe","mshta.exe","bash","sh","curl","wget")
 | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName),
(SecurityEvent
 | where EventID == 4688
 | where ParentProcessName has_any ("node.exe","npm.exe","npm.cmd")
 | where NewProcessName has_any ("cmd.exe","powershell.exe","pwsh.exe","curl.exe","mshta.exe")
 | project TimeGenerated, Computer, ParentProcessName, CommandLine, NewProcessName, Account),
(Syslog
 | where ProcessName =~ "node"
 | where SyslogMessage has_any ("child_process","/bin/sh","/bin/bash","curl ","wget ")
 | project TimeGenerated, Computer, ProcessName, SyslogMessage)
| order by Timestamp desc

// Hunt for runtime npm supply-chain execution: node processes with suspicious
// command lines, spawned children, and access to credential files.
// Deploy across developer workstations and CI/CD runners.
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)node|npm|yarn|pnpm')
  AND (
    CommandLine =~ '(?i)child_process|curl |wget |powershell|/bin/sh|/bin/bash'
    OR CommandLine =~ '(?i)\.npmrc|\.aws/credentials|\.env'
  )

// Correlate: node processes holding open handles to credential material
SELECT Pid, Name, CommandLine, Handle.Name AS OpenFile
FROM handles()
WHERE Name =~ '(?i)node'
  AND Handle.Name =~ '(?i)\.npmrc|\.aws..credentials|id_rsa|\.env$'

#!/bin/bash
# npm supply-chain hygiene audit: find indexed-btree and suspicious runtime
# behaviors across repositories, lockfiles, and installed node_modules trees.
# Run from your monorepo root, CI checkout, or developer fleet via your EDR/MDM.

set -euo pipefail

echo "=== [1/4] Scanning lockfiles for known-malicious / unreviewed packages ==="
find . -name "package-lock.json" -o -name "yarn.lock" -o -name "pnpm-lock.yaml" 2>/dev/null | \
while read -r lockfile; do
  if grep -qiE 'indexed-btree' "$lockfile"; then
    echo "[!] MALICIOUS PACKAGE FOUND in $lockfile — treat as incident, rotate all secrets reachable from that environment"
  fi
done

echo "=== [2/4] Checking installed node_modules ==="
find . -type d -name "indexed-btree" -path "*/node_modules/*" 2>/dev/null | while read -r d; do
  echo "[!] Malicious package installed at: $d"
done

echo "=== [3/4] Auditing dependencies for unexpected postinstall hooks (defense-in-depth) ==="
find . -name "package.json" -path "*/node_modules/*" 2>/dev/null | \
  xargs grep -lE '"(preinstall|postinstall|install)"' 2>/dev/null | head -50 || true

echo "=== [4/4] Verifying npm client hardening defaults ==="
npm config get ignore-scripts
echo "Recommendation: set 'ignore-scripts=true' globally AND add runtime EDR coverage —"
echo "install-script suppression alone does NOT stop this campaign."

echo ""
echo "Done. Any [!] finding = open an IR ticket, revoke npm/cloud/CI tokens reachable"
echo "from the affected host or pipeline, and rebuild the environment from clean state."

# Windows developer-fleet audit for the indexed-btree npm campaign and
# suspicious node runtime behavior. Deploy via Intune, GPO startup script,
# or your RMM. Output is designed for central collection.

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# 1) Search user profiles and common repo roots for the malicious package
$searchRoots = @("$env:USERPROFILE\source", "$env:USERPROFILE\repos", "$env:USERPROFILE\dev", "C:\projects", "C:\dev")
foreach ($root in $searchRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Filter "package-lock.json" -ErrorAction SilentlyContinue | ForEach-Object {
            if (Select-String -Path $_.FullName -Pattern 'indexed-btree' -Quiet) {
                $report += [PSCustomObject]@{
                    Severity = 'CRITICAL'
                    Finding  = "Malicious package 'indexed-btree' referenced in lockfile"
                    Path     = $_.FullName
                    Host     = $env:COMPUTERNAME
                }
            }
        }
        Get-ChildItem -Path $root -Recurse -Directory -Filter "indexed-btree" -ErrorAction SilentlyContinue |
            Where-Object { $_.FullName -like "*node_modules*" } | ForEach-Object {
                $report += [PSCustomObject]@{
                    Severity = 'CRITICAL'
                    Finding  = "Malicious package installed on disk"
                    Path     = $_.FullName
                    Host     = $env:COMPUTERNAME
                }
            }
    }
}

# 2) Check npm client hardening
$ignoreScripts = (& npm config get ignore-scripts 2>$null)
if ($ignoreScripts -ne 'true') {
    $report += [PSCustomObject]@{
        Severity = 'MEDIUM'
        Finding  = "npm ignore-scripts is not enabled (defense-in-depth gap)"
        Path     = 'npm config'
        Host     = $env:COMPUTERNAME
    }
}

# 3) Flag node processes currently spawning shells (runtime payload behavior)
Get-CimInstance Win32_Process -Filter "Name='cmd.exe' OR Name='powershell.exe'" |
    Where-Object {
        $parent = (Get-Process -Id $_.ParentProcessId -ErrorAction SilentlyContinue).ProcessName
        $parent -match '^(node|npm)$'
    } | ForEach-Object {
        $report += [PSCustomObject]@{
            Severity = 'HIGH'
            Finding  = "node process spawned shell: $($_.CommandLine)"
            Path     = $_.ExecutablePath
            Host     = $env:COMPUTERNAME
        }
    }

$report | Format-Table -AutoSize
if ($report.Severity -contains 'CRITICAL') {
    Write-Output "ACTION REQUIRED: Rotate all credentials reachable from this host (npm tokens, cloud keys, .env secrets) and rebuild from a clean image."
}