A malicious npm package called indexed-btree is impersonating the legitimate sorted-btree library while sidestepping the install-script defenses that npm added to block supply chain attacks. The package has accumulated 2 million weekly downloads, according to research from Checkmarx. The campaign is ongoing and shows how attackers can hide malicious code in a package's normal runtime behavior rather than in installation scripts.
GitHub announced npm security measures in June 2026 to help prevent supply chain attacks that have repeatedly shaken open-source ecosystems since late 2025. One key measure blocks dependency lifecycle scripts, including preinstall, install and postinstall, unless a user explicitly approves them. Other protections stop npm from automatically pulling dependencies from Git repositories or remote URLs without permission. The indexed-btree package avoids those controls entirely because its loader sits in the BTree.prototype.set method, which runs at runtime when an application calls it with a specific key value.
Because the package triggers no installation behavior, its setup appears clean and does not activate npm v12's approval mechanisms. Checkmarx said the loader hides inside the library's own BTree.prototype.set method, the main function every user would call constantly. That method triggers sharedLoad.min.js, which holds the obfuscated first stage of the malware. Checkmarx described the technique as well built for slipping past standard taint-analysis tools and most static scanners.
Once running, the malware can gather system details including architecture, hostname, CPU, memory and uptime, then send that data out through hardcoded Slack and Telegram channels. It also polls an Ethereum smart contract on the Sepolia test network for command-and-control instructions. Using X25519 key exchange, it derives an AES key and decrypts a second-stage payload stored in the contract. The operators can end an attack by deleting the malware's files and removing the malicious trigger from the package code to erase their traces.
Checkmarx found that the attackers worked to make the project look legitimate, building a convincing GitHub repository, filling out its commit history and curating the developer account. The researchers also identified nine additional npm packages tied to the same operation and had them removed from npm; those packages also reached significant download numbers.
The campaign may have generated substantial profits for the attackers, who use a wallet holding 109 ETH, according to Checkmarx. The report does not state that those funds came from cryptocurrency theft. Checkmarx advises developers not to depend on install-time scanning alone and to add runtime behavioral analysis. Anyone who installed indexed-btree or the other linked packages should rotate all secrets and restore their development environment from a safe backup.
More cybersecurity news from TechManNews.
