Supply Chain · Watch Sunday · 20 September 2026 End-of-day synthesis 4 watches · 1 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — A single npm campaign, 'indexed-btree', confirms attackers have moved malicious payloads out of install scripts and into runtime code to dodge the defenses built for the last wave.

Today was quiet by the standard of the last two weeks: one story carried the whole day, and it's the kind that matters more than a busier list would.

The 'indexed-btree' npm campaign moves the malicious payload out of install/postinstall scripts and into ordinary runtime code, which is exactly where SCA tooling and CI install-gates stop looking once a package installs clean. That's the same evolutionary pressure we've been tracking since Shai-Hulud and the Rapuncel/LastPass campaigns forced attackers off install-time hooks — this is the next logical adaptation, not a one-off.

→ Operational priority for the night grep dependency trees for 'indexed-btree' and extend SCA/CI checks to flag runtime-triggered network or filesystem calls, not just install-script behavior.

12:00 ET · Forenoon Watch

Critical · BleepingComputer ·added 12:00 ET

Malicious npm package 'indexed-btree' hides its payload in runtime code, not install scripts

The npm package 'indexed-btree' carries its malicious payload in normal runtime code rather than in install/postinstall scripts, so scanners and CI gates that only inspect install-time behavior never see it fire. It's the logical next move for attackers now that install-script sandboxing and postinstall scrutiny have become standard supply-chain defenses — push the payload downstream into code that only runs when the package is actually used. Don't treat a clean install as a clean package: extend SCA tooling to flag runtime-triggered network or filesystem calls, and grep any recent dependency tree for 'indexed-btree' specifically.