Malicious npm Package With 2 Million Downloads Hides Malware in Runtime Code

A malicious npm package that appeared to be an ordinary data-indexing tool has exposed a weakness in software supply-chain defenses.

The package, indexed-btree, copied the identity of the legitimate sorted-btree library and recorded almost two million weekly downloads. The campaign is notable because the malware does not need to run while a developer installs it.

Instead, it waits inside normal application code and activates when the library is used, turning a trusted dependency into a route for host profiling, data theft, and follow-on payload delivery. Researchers at Checkmarx identified the activity.

Checkmarx said in a report shared with Cyber Security News (CSN) that the operation shows why checks focused only on install scripts can miss threats that execute later.

The scale creates risk for organizations whose projects may have pulled the package into build systems, test environments, or production services.

Attackers also created a convincing repository and account history, adding credibility to a package designed to blend into routine development work.

Malicious npm Package With 2 Million Downloads

Indexed-btree has no preinstall or postinstall command in its package configuration, so installing it alone does not trigger the malicious routine. That absence can make a package look safe during a quick review.

The loader is placed in BTree.prototype.set, a core method likely to be called as an application stores data. When the required condition is met, that code starts an obfuscated first-stage component, allowing the threat to run during normal program activity rather than at the more closely watched installation stage.

This design changes the defensive question from whether a package has a risky installer to what it does after import and use. Earlier reports on malicious package mirror abuse show attackers continue to adapt trusted developer channels for delivery.

The first stage gathers the operating-system architecture, host name, processor, memory, and system uptime. It sends this information to attacker-controlled destinations, then consults a smart contract on the Ethereum Sepolia test network instead of a conventional command server.

That blockchain-based design can make disruption harder because the contract can point malware to a replacement address if an earlier destination is blocked.

The code then uses a cryptographic key exchange to derive a decryption key and combine encrypted data from the contract into a second-stage payload, according to the research.

The package also includes functions intended to remove malware files and erase the trigger from the prototype method. The cleanup could limit evidence after the application first uses the library.

Supply-Chain Defenses Need Runtime Checks

The campaign illustrates a gap when security teams treat the absence of lifecycle scripts as proof that an npm package is harmless. That control does not examine malicious behavior embedded directly in a package’s main JavaScript functions.

Organizations should identify whether affected package names or versions are present in source trees, lockfiles, build images, developer workstations, and continuous-integration systems.

Teams should remove them, rotate potentially exposed secrets, and inspect logs for the indicators listed below. Dependency review should include ownership, release history, repository consistency, and code distributed through the registry.

A recent npm package compromise report also shows how trusted dependencies can become a direct route into developer and CI environments.

For stronger coverage, teams should run suspicious packages in isolated environments and monitor child processes, filesystem changes, network calls, and behavior after common methods are invoked. This can reveal malicious runtime paths that static scans overlook.

Developers should pin reviewed dependency versions, keep software bills of materials current, and enforce approval for new or abruptly changed packages.

The broader pattern has included backdoored npm package waves and binding configuration abuse, reinforcing the need to watch installation and execution.

For responders, the priority is to determine whether the library was merely downloaded or actually used in a running process. Runtime evidence, process records, and network telemetry may provide the clearest answer while the campaign remains active.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Malicious npm package	indexed-btree	Primary malicious package impersonating sorted-btree
Malicious npm package	ordered-kv-index	Subsequently removed related package
Malicious npm package	btree-leaderboard	Subsequently removed related package
Malicious npm package	priority-slot-queue	Subsequently removed related package
Malicious npm package	btree-range-store	Subsequently removed related package
Malicious npm package	btree-core	Subsequently removed related package
Malicious npm package	btree-time-index	Subsequently removed related package
Malicious npm package	btree-lru-cache	Subsequently removed related package
Malicious npm package	neighbor-key-map	Subsequently removed related package
Malicious npm package	sliding-score-window	Subsequently removed related package
Related npm package	mutex-forge	Earlier package associated with the same smart contract
File name	sharedLoad.min.js	Obfuscated first-stage malware component
GitHub repository	https://github.com/INDEXED-BTREE/indexed-btree/commits/main/	Repository used to make the package appear legitimate
Ethereum Sepolia contract	0xE390863Dac96a7118C71227C2b099B50cF602D31	Smart contract used as a command-and-control channel
RPC endpoint	https://eth-sepolia.g.alchemy.com/v2/D2-TbkB2m05WXSnSDOCDI	Ethereum Sepolia RPC endpoint
RPC endpoint	https://sepolia.infura.io/v3/dc7257d09fab42eca2c354c32fec1938	Ethereum Sepolia RPC endpoint
Telegram bot token	8961878831:AAG4WTbRUcbXI5UCaN4VXK8k57ghqqkg_qI	Telegram data-exfiltration bot token
Telegram chat ID	-1003952553968	Telegram data-exfiltration destination
Slack bot token	xoxb-11307403103236-11289767127959-U58yt3zLurAvVoZOf0OBtxCW	Slack data-exfiltration bot token
Slack channel ID	C0B8XPGCKQS	Slack data-exfiltration destination
X25519 public key	bad013df6eec5d686f4cc8551e0a5c87a0135164bdd1dafb1c75141d1b526702	Hardcoded SPKI/DER public key in hexadecimal format

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC