--- title: Your npm install was safe. What happens when the package... description: Blocking npm install scripts does not stop a package from turning malicious once your application calls its functions. The indexed-btree package imitated the... canonical: https://daily.dev/posts/your-npm-install-was-safe-what-happens-when-the-package-runs--nkcyzx4rn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Your npm install was safe. What happens when the package runs? | daily.dev og:description: Blocking npm install scripts does not stop a package from turning malicious once your application calls its functions. The indexed-btree package imitated the... og:url: https://daily.dev/posts/your-npm-install-was-safe-what-happens-when-the-package-runs--nkcyzx4rn og:image: https://api.daily.dev/og/posts/NKcYzX4rn.png og:image:alt: Your npm install was safe. What happens when the package runs? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Your npm install was safe. What happens when the package runs? **[InfoWorld](https://daily.dev/sources/infoworld)** · 8 min read · 2 upvotes · 0 comments ## Summary Blocking npm install scripts does not stop a package from turning malicious once your application calls its functions. The indexed-btree package imitated the legitimate sorted-btree library and hid its loader inside BTree.prototype.set, a normal method call, not an install hook. Checkmarx Zero found that a specific key value triggered an obfuscated file launched in a separate Node process. Npm's ignore-scripts setting only blocks installation-time scripts; it can't inspect runtime code paths. Recommended defenses include dependency diffs on every pull request, GitHub's dependency review in branch protection, testing packages in isolated environments without production secrets, and limiting the credentials available to processes that run third-party code. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did the malicious indexed-btree npm package avoid detection by install-script scanners? It had no malicious install hook at all. Instead, Checkmarx Zero found its loader embedded inside BTree.prototype.set, a method the application calls during normal use while imitating the legitimate sorted-btree library. The payload triggered only when a particular key value was passed to set, then launched an obfuscated file in a separate Node process. _Teams hardening dependency review against supply-chain attacks can track cases like this on daily.dev._ ### Does disabling npm postinstall and preinstall scripts fully protect against malicious packages? No, it only prevents code from running during installation. Npm's ignore-scripts setting blocks scripts declared in package.json at install time, but it cannot inspect what runs later when the application calls the package's functions with its own permissions, environment variables, and network access. The indexed-btree case showed malicious code triggered entirely through normal runtime function calls. _Developers weighing how far npm's built-in protections really go can follow supply-chain coverage on daily.dev._ ### What should a code review check for when a pull request adds or updates an npm dependency? It should produce a dependency diff showing the exact package name, version, provenance when available, and the published files that will run, rather than only checking for known vulnerabilities. A new name, a look-alike package, a changed publisher, or an unexplained obfuscated file should pause the merge for a designated reviewer to investigate, since a package like indexed-btree needed no CVE to be dangerous. _Engineers building dependency-review gates into CI can keep up with emerging npm attack patterns on daily.dev._ ## Similar posts on daily.dev - [Why npm dependencies are a bigger security risk than your code](https://daily.dev/posts/why-npm-dependencies-are-a-bigger-security-risk-than-your-code-zyi7hulam) · LogRocket · 0 upvotes · 0 comments - [Defending yourself against compromised npm packages](https://daily.dev/posts/defending-yourself-against-compromised-npm-packages-rw8vi7mss) · The Art of Simplicity · 1 upvotes · 0 comments - [GitHub finally pulls the plug on automatic install script execution for npm](https://daily.dev/posts/github-finally-pulls-the-plug-on-automatic-install-script-execution-for-npm-lq84iidjt) · InfoWorld · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#javascript](https://daily.dev/tags/javascript), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/your-npm-install-was-safe-what-happens-when-the-package-runs--nkcyzx4rn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Your npm install was safe. What happens when the package runs?","url":"https://daily.dev/posts/your-npm-install-was-safe-what-happens-when-the-package-runs--nkcyzx4rn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/your-npm-install-was-safe-what-happens-when-the-package-runs--nkcyzx4rn"},"datePublished":"2026-10-26T09:04:56.013Z","dateModified":"2026-10-26T11:03:04.540Z","description":"Blocking npm install scripts does not stop a package from turning malicious once your application calls its functions. The indexed-btree package imitated the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8d8929445a4acafeccf1c4620b55e7aa?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8d8929445a4acafeccf1c4620b55e7aa?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoWorld","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoWorld","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/bf6d68a999064029b0bb09aa6268f1f3","url":"https://daily.dev/sources/infoworld"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/your-npm-install-was-safe-what-happens-when-the-package-runs--nkcyzx4rn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,javascript,malware,npm","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoWorld","item":"https://daily.dev/sources/infoworld"},{"@type":"ListItem","position":3,"name":"Your npm install was safe. What happens when the package runs?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/your-npm-install-was-safe-what-happens-when-the-package-runs--nkcyzx4rn#faq","mainEntity":[{"@type":"Question","name":"How did the malicious indexed-btree npm package avoid detection by install-script scanners?","acceptedAnswer":{"@type":"Answer","text":"It had no malicious install hook at all. Instead, Checkmarx Zero found its loader embedded inside BTree.prototype.set, a method the application calls during normal use while imitating the legitimate sorted-btree library. The payload triggered only when a particular key value was passed to set, then launched an obfuscated file in a separate Node process. Teams hardening dependency review against supply-chain attacks can track cases like this on daily.dev."}},{"@type":"Question","name":"Does disabling npm postinstall and preinstall scripts fully protect against malicious packages?","acceptedAnswer":{"@type":"Answer","text":"No, it only prevents code from running during installation. Npm's ignore-scripts setting blocks scripts declared in package.json at install time, but it cannot inspect what runs later when the application calls the package's functions with its own permissions, environment variables, and network access. The indexed-btree case showed malicious code triggered entirely through normal runtime function calls. Developers weighing how far npm's built-in protections really go can follow supply-chain coverage on daily.dev."}},{"@type":"Question","name":"What should a code review check for when a pull request adds or updates an npm dependency?","acceptedAnswer":{"@type":"Answer","text":"It should produce a dependency diff showing the exact package name, version, provenance when available, and the published files that will run, rather than only checking for known vulnerabilities. A new name, a look-alike package, a changed publisher, or an unexplained obfuscated file should pause the merge for a designated reviewer to investigate, since a package like indexed-btree needed no CVE to be dangerous. Engineers building dependency-review gates into CI can keep up with emerging npm attack patterns on daily.dev."}}]} ```