Malicious npm packages evade install-script defenses at runtime

An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by hiding malicious code in a package's normal runtime behavior rather than in installation scripts.

The package, spotted by Checkmarx researchers, attempts to impersonate the legitimate 'sorted-btree' library and has already amassed 2 million weekly downloads.

The campaign may also have generated significant profits for the attackers, who, according to Checkmarx, use a wallet holding 109 ETH. However, the report does not say those funds came from cryptocurrency theft.

Bypassing latest security measures

In June 2026, GitHub announced a set of npm security measures designed to help prevent supply chain attacks that have shaken open-source ecosystems repeatedly since late 2025.

One key security measure is to block dependency lifecycle scripts such as 'preinstall', 'install ', and 'postinstall,' unless explicitly approved.

Other measures prevent npm from automatically retrieving dependencies from Git repositories or remote URLs without permission.

The malicious indexed-btree package sidesteps these protections by avoiding installation scripts and instead hiding its loader in the package's BTree.prototype.set() method, which executes at runtime when the application calls it with a specific key value.

As a result, installation appears clean and triggers none of npm v12's approval mechanisms.

"The malware loader hides inside the library's own BTree.prototype.set method, which is the main function that every user would call constantly," explains Checkmarx.

"This triggers the sharedLoad.min.js, which contains the obfuscated first stage of the malware. This is a well-built way to sneak past standard taint-analysis tools and most static scanners."

Once the malware is executed, it can collect system details, including architecture, hostname, CPU, memory, and uptime, and exfiltrate the information through hardcoded Slack and Telegram channels.

The malware also polls an Ethereum smart contract on the Sepolia test network for command-and-control (C2) information. It uses X25519 key exchange to derive an AES key and decrypt a second-stage payload stored in the contract.

When the operators choose to end the attack, the malware can delete its files and remove the malicious trigger from the package code to wipe its traces.

The researchers note that the threat actors have gone to great lengths to make the project appear legitimate, including building a legitimate-looking GitHub repository, populating its commit history, and curating the developer account.

Checkmarx also discovered nine additional npm packages linked to the same operation, which it has now removed from npm. Those also achieved significant download numbers, as seen here:

1. ordered-kv-index (448,184 downloads)
2. btree-leaderboard (493,685 downloads)
3. priority-slot-queue (402,860 downloads)
4. btree-range-store (468,092 downloads)
5. btree-core (1,951,274 downloads)
6. btree-time-index (425,312 downloads)
7. btree-lru-cache (372,185 downloads)
8. neighbor-key-map (366,019 downloads)
9. sliding-score-window (448,024 downloads)

Developers are advised not to rely on install-time scanning alone, and to also employ runtime behavioral analysis.

Those who installed indexed-btree or any of the above-listed packages should rotate all secrets and restore their development environment from a safe backup.