Malicious B-tree NPM Package Accumulates Millions of Downloads
Ongoing NPM supply chain campaign hides malware in indexed-btree's prototype code, reaching 2 million weekly downloads before detection.
Checkmarx reports an ongoing NPM supply chain attack where indexed-btree, mimicking the legitimate sorted-btree library, reached 2 million weekly downloads by hiding its trigger in the BTree.prototype.set method instead of an install script, bypassing NPM protections. The first stage collects system information, exfiltrates it to a hardcoded Slack channel and Telegram chat, then retrieves and decrypts a second stage from a Sepolia blockchain smart contract serving as C2. Nine related packages (btree-core, btree-lru-cache, sliding-score-window, and others) accumulated over 5 million downloads before removal. A legitimate-looking GitHub repository with many commits built trust, and the actor's contract was previously seen in mutex-forge, with an apparent profit of 109 ETH (about $300,000).
- indexed-btree mimicked sorted-btree and hit 2 million weekly downloads before detection
- Malicious trigger hidden in BTree.prototype.set bypassed NPM install-script protections
- C2 is a Sepolia blockchain smart contract; data exfiltrated to hardcoded Slack/Telegram
- Nine related packages totaled 5+ million downloads before removal
- Same smart contract previously seen in mutex-forge; actor earned ~109 ETH ($300,000)
Full article358 words · extracted from securityweek.com · click to collapse
The NPM ecosystem has suffered another supply chain attack in which a malicious package has accumulated millions of downloads, Checkmarx reports.
Still ongoing, the campaign has managed to bypass NPM’s recent protections by hiding a malicious trigger in the package’s JavaScript prototype code, rather than using an install script that could be detected by security solutions.
Instead of targeting highly popular packages for fast propagation, and likely immediate detection, the threat actor built trust by creating a legitimate-looking GitHub repository.
The malicious package, indexed-btree, mimics the legitimate B-tree/indexing utility sorted-btree, and has reached 2 million weekly downloads before being detected, Checkmarx says.
To ensure the package’s popularity, the threat actor created a GitHub account and added seemingly legitimate commits to the indexed-btree repository.
“A GitHub repository is something that attackers don’t usually bother creating. This one is clever enough to not include the malicious code. Additionally, the presence of many commits can aid in making it look like a legit repository,” Checkmarx notes.
Advertisement. Scroll to continue reading.
The threat actor hid malicious code in the library’s main function, the BTree.prototype.set method, to trigger JavaScript code containing the malware’s first stage.
Once executed, the malware collects system information and sends it to a hardcoded Slack channel and Telegram chat, connects to a blockchain contract deployed on Sepolia that serves as its command-and-control (C&C), extracts and decrypts the second stage from the contract, and cleans its traces.
According to Checkmarx, the attacker’s smart contract was previously found in the mutex-forge package, and the threat actor appears to have made 109 ETH (nearly $300,000).
In addition to indexed-btree, other packages linked to the supply chain campaign include ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, and sliding-score-window, which had over 5 million downloads when removed.
“This ongoing campaign is a dynamic threat to organizations, with a resilient C&C and malicious code hidden inside package code,” Checkmarx notes.
Related: Rust Team Members and Popular Crate Owners Targeted via Video Calls
Related: CrowdSec Confirms Source Code Stolen in Supply Chain Attack
Related: Brevo Supply Chain Attack Injects Malware Into 100,000 Websites
Related: Rust Supply Chain Attack Linked to North Korean Hackers