New npm malware finds a way around install script defenses
Checkmarx details npm supply-chain malware hiding in BTree methods, using Ethereum smart-contract C2 and Slack/Telegram exfiltration; ten packages pulled.
Checkmarx uncovered malicious npm packages, including btree-core with more than 1.9 million downloads, that embed their payload in the BTree.prototype.set runtime method to bypass npm's June lifecycle-script restrictions. A detached Node.js loader fingerprints the host (architecture, hostname, CPU, memory, uptime) and exfiltrates data to hardcoded Slack and Telegram channels. The C2 address is hidden in a Sepolia Ethereum testnet smart contract whose getter/setter functions the malware polls, providing takedown resilience; a second-stage payload is unlocked from encrypted contract chunks. Nine additional packages were removed from the registry, and attackers maintained a legitimate-looking GitHub repository with an AI-generated profile image; the campaign is ongoing and IOCs were shared.
- Malware embedded in BTree.prototype.set runtime method, not install scripts, dodging npm's June defenses
- C2 address hidden in Sepolia Ethereum testnet smart contract with getter/setter polling
- Host fingerprint exfiltrated to hardcoded Slack channel and Telegram chats
- Ten packages removed; btree-core alone had 1.9M+ downloads
Full article379 words · extracted from csoonline.com · click to collapse
The discovery comes after npm introduced tighter controls around lifecycle scripts in June.
Blockchain C2 combined with Slack/Telegram data theft
The malicious script was embedded directly into a runtime method “BTree.prototype.set”, instead of an install hook in the package’s package.json. When the method receives a particular key value, the code launches an obfuscated first-stage loader as a detached Node.js process.
Once launched, the loader fingerprints the host, collecting information including the operating system architecture, hostname, CPU, memory and uptime. The data is then exfiltrated using hardcoded Slack channel and Telegram chats.
The attackers hid the command-and-control (C2) server address in a smart contract on the Sepolia Ethereum testnet blockchain.
“The contract exposes getter and setter functions that the malware polls instead of requesting a plain domain,” Checkmarx researchers said. “This technique is more resilient to domain / IP takedown than traditional C2 approaches, since it uses the smart contract as a pointer to a new address whenever the old one gets taken down.
Further in the chain, the malware creates cryptographic keys to establish a shared secret with a public key retrieved from the blockchain. This secret is ultimately used to unlock a second-stage payload from two encrypted chunks in the smart contract.
Checkmarx did not say what the second-stage loader does, but it did point out that the malware cleans up after itself. It contains “functionality to delete the malware files and remove the trigger code from the main prototype function,” the researchers noted.
Nine more packages broaden the campaign
Checkmarx also identified nine other npm packages linked to the campaign, which were subsequently removed from the registry. These included ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, and sliding-score-window.
Several of these packages had hundreds of thousands of downloads, while btree-core had more than 1.9 million downloads.
The operators tried making the package ecosystem look legitimate, Checkmarx noted, maintaining a GitHub repository with numerous commits while keeping the malicious code itself out of the repository. The associated GitHub account too used an AI-generated profile image.
Checkmarx said the campaign is ongoing and that its findings may change as the investigation develops. It shared a list of indicators of compromise (IOCs) for security teams to use in detection and monitoring.
This article first appeared on InfoWorld.