Malicious B-tree NPM Package Accumulates Millions of Downloads
Ongoing NPM supply chain campaign hides malware in indexed-btree's prototype code, reaching 2 million weekly downloads before detection.
Checkmarx reports an ongoing NPM supply chain attack where indexed-btree, mimicking the legitimate sorted-btree library, reached 2 million weekly downloads by hiding its trigger in the BTree.prototype.set method instead of an install script, bypassing NPM protections. The first stage collects system information, exfiltrates it to a hardcoded Slack channel and Telegram chat, then retrieves and decrypts a second stage from a Sepolia blockchain smart contract serving as C2. Nine related packages (btree-core, btree-lru-cache, sliding-score-window, and others) accumulated over 5 million downloads before removal. A legitimate-looking GitHub repository with many commits built trust, and the actor's contract was previously seen in mutex-forge, with an apparent profit of 109 ETH (about $300,000).
- indexed-btree mimicked sorted-btree and hit 2 million weekly downloads before detection
- Malicious trigger hidden in BTree.prototype.set bypassed NPM install-script protections
- C2 is a Sepolia blockchain smart contract; data exfiltrated to hardcoded Slack/Telegram
- Nine related packages totaled 5+ million downloads before removal
- Same smart contract previously seen in mutex-forge; actor earned ~109 ETH ($300,000)
- ATT&CK
- T1195.002 Supply Chain Compromise: Compromise Software Supply ChainT1082 System Information DiscoveryT1102.002 Indicator Removal on Host: File and Directory Permissions Modification
- Organizations
- Checkmarxnpmindexed-btree
From the original article
2 min read at securityweek.com
Posing as the legitimate sorted-btree package, indexed-btree hides a malware trigger in its prototype method. The post Malicious B-tree NPM Package Accumulates Millions of Downloads appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.