Malicious npm Package With 2 Million Downloads Hides Malware in Runtime Code
Malicious npm package 'indexed-btree' with 2M weekly downloads hides runtime malware using blockchain-based command-and-control.
75
Malware
indexed-btree
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 21, 2026
- Last mentionedSep 21, 2026
Timeline
2 articles · newest first10 Malicious npm Packages Linked to Runtime Malware Campaign With Millions of Downloads
10 malicious npm packages with millions of downloads bypass install-time checks by loading malware at runtime, using Ethereum for C2.
68
Appears with
- Checkmarxorganization · 2
- Snykorganization · 1
- btree-time-indexmalware · 1
- btree-leaderboardmalware · 1
- Ethereumproduct · 1
- priority-slot-queuemalware · 1
- neighbor-key-mapmalware · 1
- npmvendor · 1
- btree-lru-cachemalware · 1
- Threat Actorthreat actor · 1
- sliding-score-windowmalware · 1
- btree-coremalware · 1
- npmproduct · 1
- btree-range-storemalware · 1
- ordered-kv-indexmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.