10 Malicious npm Packages Linked to Runtime Malware Campaign With Millions of Downloads
10 malicious npm packages with millions of downloads bypass install-time checks by loading malware at runtime, using Ethereum for C2.
A sophisticated npm supply-chain campaign involved 10 malicious JavaScript packages that collectively received millions of downloads. The malware bypasses npm lifecycle protections by embedding a loader inside a core library method (BTree.prototype.set()), triggering only at runtime. It uses an Ethereum Sepolia testnet smart contract for command-and-control, exfiltrates host data via Slack and Telegram, and implements key exchange for payload decryption. The primary package, 'indexed-btree', was classified as critical (9.3 severity) and has been removed from npm.
68