Malicious npm packages evade install-script defenses at runtime
Malicious npm package 'indexed-btree' hides a loader in runtime code to evade install-script defenses, reaching 2 million weekly downloads alongside nine related packages.
Checkmarx researchers found the typosquatted 'indexed-btree' npm package, impersonating 'sorted-btree', hides an obfuscated loader in BTree.prototype.set() that triggers at runtime, bypassing npm v12's June 2026 install-script approval requirements. Once invoked, it collects system details, exfiltrates data via hardcoded Slack and Telegram channels, and polls an Ethereum Sepolia smart contract for C2, using X25519 key exchange and AES to decrypt a second stage. Nine linked packages totaling millions of downloads were removed, and developers are urged to rotate secrets and rebuild compromised environments.
- Loader hidden in BTree.prototype.set() executes only when apps call it with a specific key
- Evades npm v12 install-script blocking and most static and taint-analysis scanners
- Exfiltrates host info through Slack and Telegram; C2 config fetched from Ethereum smart contract
- Operators' wallet holds 109 ETH; legitimacy faked via curated repo and commit history
- Nine related packages (e.g. btree-core, 1.95M downloads) removed from npm
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1082 System Information DiscoveryT1027 Obfuscated Files or InformationT1041 Exfiltration Over C2 ChannelT1573 Encrypted Channel
- Products
- indexed-btreesorted-btreenpm
From the original article
2 min read at bleepingcomputer.com
An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by hiding malicious code in a package's normal runtime behavior rather than in installation scripts. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.