Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal

A malicious npm package named "indexed-btree" has been observed hiding its malicious behavior within application code rather than using lifecycle scripts, indicating that threat actors are likely shifting tactics in response to recent security controls.

"Indexed-btree is a malicious npm package mimicking the legit sorted-btree package, an ordinary B-tree/indexing utility," Checkmarx said. "Unlike the common attacks we've seen in the supply chain space, this package does not rely on preinstall / postinstall at all. Instead, it runs entirely from application code at runtime."

The package and the associated GitHub repository are no longer available for download from npm. However, statistics show the package was first uploaded to the registry on June 18, 2026, by an npm user named "charlessadler25," amassing millions of downloads in a short span of time.

To make matters worse, the campaign may have generated illicit profits for the threat actor, earning them around €230,933.57 in cryptocurrency (i.e., 109 ETH).

The development comes as npm version 12 introduced a security change to prevent automatic execution of lifecycle scripts such as preinstall or postinstall, which is one of the most common ways malware is executed through packages distributed through the repository.

"Legitimately, these are often used for compiling necessary code, seeding data, or setting up essential configurations," Checkmarx said. "For threat actors, however, this is frequently exploited to automatically execute malicious code without user consent during the installation of a malicious package."

The latest findings from the software supply chain security company show that bad actors are shifting tactics in response to the change, eschewing install hooks in favor of incorporating the malicious code directly within the library.

In this case, the malware loader is concealed inside a "BTree.prototype.set()" method, which then triggers "sharedLoad.min.js," a JavaScript payload that embeds the obfuscated first stage of the malware.

The malware is designed to fingerprint the host, beacon the details to a hard-coded Slack channel and Telegram bot, uses the EtherHiding technique to pull next-stage, encrypted blobs from a smart contract deployed on Sepolia testnet, and finally merge them to form the second-stage payload.

The final step involves deleting the malicious artifacts and removing the trigger from the package code to cover up the tracks.

Checkmarx said indexed-btree is one of the many npm packages tied to the same operation, all of which have since been removed from npm -

• ordered-kv-index
• btree-leaderboard
• priority-slot-queue
• btree-range-store
• btree-core
• btree-time-index
• btree-lru-cache
• neighbor-key-map
• sliding-score-window
• mutex-forge

To counter the threat, developers are recommended not to stick only to install-time scanning and blocking lifecycle scripts alone, but also employ runtime behavior analysis.

"What makes this campaign particularly important is that it shows attackers adapting almost immediately to stronger software supply chain defenses," Ensar Seker, CISO at SOCRadar, said in a statement shared with The Hacker News. "Npm has improved install time security by restricting dependency lifecycle scripts, but this campaign demonstrates that attackers can simply move malicious execution into legitimate-looking runtime functionality instead."

"The broader lesson is that security controls change attacker behavior rather than eliminate the underlying threat. Blocking lifecycle scripts is an important improvement, but attackers will continue searching for alternative execution paths. Defenders, therefore, need layered controls capable of detecting malicious behavior before installation, during execution, and after deployment."

PolinRider Resurfaces on Packagist

The disclosure comes as Socket said it deleted malicious code in the "dev-main" version of "visanduma/nova-two-factor," a Packagist package with over 700,000 cumulative downloads, as part of an ongoing North Korea-linked malicious cyber campaign dubbed PolinRider.

A defining trait of PolinRider is the threat actor's pattern of compromising developer accounts to inject malicious content into source code repositories and employ routine developer actions, such as cloning a repository or opening it in an integrated development environment (IDE), as triggers to activate the infection chain.

This often entails rewriting Git history, concealing payloads within configuration or font files, setting up malicious VS Code auto-run tasks, and relying on takedown-resistant techniques like EtherHiding and its stealth-focused successor, NullReceiver, for staged-payload delivery via the blockchain.

"Analysis of the Visanduma GitHub organization indicates that its repositories have been compromised since mid-June 2026," Socket security researcher Karlo Zanki said. "The malicious changes were introduced through the LaHiRu developer account."

One notable shift observed in the latest iteration is the direct insertion of heavily obfuscated JavaScript into "index.php" and its execution through PHP's "shell_exec()" function. This approach, besides allowing a PHP entry point to invoke the JavaScript infection chain, suggests the threat actors are adapting their execution methods based on the compromised project instead of using a fixed delivery path.

"The activity reinforces a defining characteristic of PolinRider: package-registry compromise is often a consequence of a broader Git-based intrusion rather than the campaign's primary objective," Socket said. "The operators use ordinary source-code collaboration to reach developer environments, spread into additional repositories, and maintain access over time."

"Compromised source repositories give the operators opportunities to infect contributors, access private projects, and propagate through normal development workflows. Package publication becomes an additional distribution path when a compromised repository produces a new release."

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.