10 Malicious npm Packages Linked to Runtime Malware Campaign With Millions of Downloads
10 malicious npm packages with millions of downloads bypass install-time checks by loading malware at runtime, using Ethereum for C2.
A sophisticated npm supply-chain campaign involved 10 malicious JavaScript packages that collectively received millions of downloads. The malware bypasses npm lifecycle protections by embedding a loader inside a core library method (BTree.prototype.set()), triggering only at runtime. It uses an Ethereum Sepolia testnet smart contract for command-and-control, exfiltrates host data via Slack and Telegram, and implements key exchange for payload decryption. The primary package, 'indexed-btree', was classified as critical (9.3 severity) and has been removed from npm.
- 10 malicious npm packages recorded millions of downloads, evading lifecycle-script protections.
- Malware loads at runtime via a core library method, not during install hooks.
- Uses Ethereum smart contract for resilient, decentralized C2 infrastructure.
- Loader fingerprints hosts and exfiltrates data via Slack and Telegram.
- Primary package had nearly 2 million weekly downloads; linked packages removed from npm.
- Malware
- indexed-btree
From the original article
3 min read at gbhackers.com
A sophisticated npm supply-chain campaign has been linked to 10 malicious JavaScript packages that collectively recorded millions of downloads while bypassing npm’s lifecycle-script protections. The operation centers on a counterfeit package named indexed-btree, which impersonates the legitimate sorted-btree library and executes its malware only when an application uses the package at runtime.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.