Dependency installation security measure already defeated on npm

**npm supply-chain malware campaign:** Researchers discovered a malicious npm package (indexed-btree) that bypasses npm's install-script protections by embedding its payload in a library prototype method so it runs when the library is used; the malware fingerprints hosts, exfiltrates data via Slack/Telegram, and uses an Ethereum smart contract for resilient C2 while employing fake GitHub artifacts to avoid detection.