Malicious npm Package With 2 Million Downloads Hides Malware in Runtime Code
Malicious npm package 'indexed-btree' with 2M weekly downloads hides runtime malware using blockchain-based command-and-control.
75
Threat actor
Threat Actor
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 21, 2026
- Last mentionedSep 21, 2026
Timeline
2 articles · newest firstChainScript: the RAT that hides its command server inside a blockchain contract
New Node.js RAT 'ChainScript' hides command server in Polygon smart contract, spreading via ClickFix campaigns with fake Spotify/Zoom installers.
72
Appears with
- Zoom Workplaceproduct · 1
- Polygonproduct · 1
- Spotifyproduct · 1
- indexed-btreemalware · 1
- Blackpointvendor · 1
- btree-time-indexmalware · 1
- btree-leaderboardmalware · 1
- priority-slot-queuemalware · 1
- neighbor-key-mapmalware · 1
- npmvendor · 1
- ClickFixmalware · 1
- btree-lru-cachemalware · 1
- Adversary Pursuit Grouporganization · 1
- Checkmarxorganization · 1
- Node.jsproduct · 1
- sliding-score-windowmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.