Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal
Checkmarx details malicious npm package indexed-btree hiding its loader in runtime code, netting €230,000; Socket flags PolinRider Packagist compromise.
Checkmarx reports the malicious npm package indexed-btree, uploaded June 18, 2026 by user 'charlessadler25' and mimicking the legit sorted-btree library, hid its loader inside BTree.prototype.set() instead of lifecycle scripts, amassing millions of downloads and earning about €230,933 (109 ETH). The malware fingerprints hosts, beacons to a Slack channel and Telegram bot, and uses EtherHiding on a Sepolia smart contract to fetch staged encrypted payloads before deleting artifacts. Nine related packages were removed from npm. Separately, Socket detailed the North Korea-linked PolinRider campaign compromising the Packagist package visanduma/nova-two-factor via the LaHiRu developer account.
- indexed-btree hid its loader in runtime code, bypassing npm 12 lifecycle-script restrictions
- Campaign earned ~€230,933 (109 ETH) across ten removed npm packages
- Malware beacons to Slack/Telegram and pulls payloads from a Sepolia smart contract
- PolinRider (North Korea-linked) compromised Packagist's visanduma/nova-two-factor via developer account
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1036 MasqueradingT1027 Obfuscated Files or InformationT1102.002 Web Service: Bidirectional Communication
- Organizations
- CheckmarxSocketnpmPolinRider
From the original article
4 min read at thehackernews.com
A malicious npm package named "indexed-btree" has been observed hiding its malicious behavior within application code rather than using lifecycle scripts, indicating that threat actors are likely shifting tactics in response to recent security controls. "Indexed-btree is a malicious npm package mimicking the legit sorted-btree package, an ordinary B-tree/indexing utility," Checkmarx said. "
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.