Malicious npm Package With 2 Million Downloads Hides Malware in Runtime Code
Malicious npm package 'indexed-btree' with 2M weekly downloads hides runtime malware using blockchain-based command-and-control.
A malicious npm package named 'indexed-btree', impersonating the legitimate 'sorted-btree' library, was discovered with nearly two million weekly downloads. The malware bypasses standard install-time detection by activating during runtime method execution rather than preinstall/postinstall scripts. Researchers at Checkmarx found the campaign uses an Ethereum Sepolia smart contract for command-and-control infrastructure, making takedowns more difficult.
- Malicious npm package 'indexed-btree' impersonated legitimate 'sorted-btree' library.
- Malware bypasses install scripts, activating during runtime code execution.
- Attacker uses Ethereum Sepolia smart contract for resilient command-and-control.
- Package recorded nearly two million weekly downloads before discovery.
- Checkmarx researchers identified the supply-chain attack campaign.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | dc7257d09fab42eca2c354c32fec1938 | olia RPC endpoint RPC endpoint https://sepolia.infura.io/v3/dc7257d09fab42eca2c354c32fec1938 Ethereum Sepolia RPC endpoint Telegram bot token 8961878831 |
| sha256 | bad013df6eec5d686f4cc8551e0a5c87a0135164bdd1dafb1c75141d1b526702 | GCKQS Slack data-exfiltration destination X25519 public key bad013df6eec5d686f4cc8551e0a5c87a0135164bdd1dafb1c75141d1b526702 Hardcoded SPKI/DER public key in hexadecimal format Note: I |
From the original article
4 min read at cybersecuritynews.com
A malicious npm package that appeared to be an ordinary data-indexing tool has exposed a weakness in software supply-chain defenses. The package, indexed-btree, copied the identity of the legitimate sorted-btree library and recorded almost two million weekly downloads. The campaign is notable because the malware does not need to run while a developer installs it.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.