Malicious npm package bypasses security controls by hiding code in runtime execution

A malware campaign on the npm registry involving the package indexed-btree has been identified by researchers at Checkmarx. The malicious package attempts to impersonate the legitimate library sorted-btree and has accumulated two million weekly downloads. The attackers are reported to use a cryptocurrency wallet containing 109 ETH, although the report does not confirm that these funds originated from cryptocurrency theft.

The campaign circumvents recent supply chain security measures announced by GitHub in June 2026. These measures include blocking dependency lifecycle scripts such as preinstall, install, and postinstall unless explicitly approved, and preventing npm from automatically retrieving dependencies from Git repositories or remote URLs without permission. The indexed-btree package avoids installation scripts entirely. Instead, it hides its loader within the BTree.prototype.set() method, which executes at runtime when an application calls the function with a specific key value. This approach makes the installation appear clean and prevents it from triggering any approval mechanisms in npm version 12.

Checkmarx explains that the malware loader is concealed within the primary function of the library, which users call constantly. This triggers sharedLoad.min.js, containing the first obfuscated stage of the malware. This method is designed to evade standard contamination analysis tools and most static scanners. Once executed, the malware collects system details including architecture, host name, CPU, memory, and uptime. It exfiltrates this information through hardcoded channels on Slack and Telegram. The malware also queries an Ethereum smart contract on the Sepolia test network for command and control information. It uses X25519 key exchange to derive an AES key and decrypt a second-stage payload stored in the contract. Operators can terminate the attack by having the malware delete its files and remove the malicious trigger from the package code.

Researchers note that the threat actors made significant efforts to make the project appear legitimate, including building a credible GitHub repository, populating its commit history, and curating the developer account. Checkmarx also discovered nine additional npm packages linked to the same operation, which have now been removed from the registry. These packages achieved significant download numbers: ordered-kv-index with 448,184 downloads, btree-leaderboard with 493,685, priority-slot-queue with 402,860, btree-range-store with 468,092, btree-core with 1,951,274, btree-time-index with 425,312, btree-lru-cache with 372,185, neighbor-key-map with 366,019, and sliding-score-window with 448,024.

Developers are advised not to rely solely on installation-time verification but to employ runtime behavioral analysis. Those who installed indexed-btree or any of the listed packages should rotate all secrets and restore their development environment from a secure backup.