An ongoing npm malware campaign centred on the indexed-btree package shows how threat actors bypass supply-chain defences by hiding malicious code in a package's normal runtime behaviour rather than in installation scripts. The package, spotted by Checkmarx, impersonates the legitimate sorted-btree library and has amassed 2 million weekly downloads. In June 2026 GitHub introduced npm measures that block dependency lifecycle scripts such as preinstall, install and postinstall unless explicitly approved, and that stop npm retrieving dependencies from Git repositories or remote URLs without permission. indexed-btree sidesteps both by avoiding installation scripts entirely and hiding its loader inside BTree.prototype.set(), which executes at runtime when an application calls it with a specific key value — installation looks clean and triggers none of npm v12's approval mechanisms, and Checkmarx notes this also defeats most static scanners and taint-analysis tools. The first stage, sharedLoad.min.js, collects architecture, hostname, CPU, memory and uptime data and exfiltrates it through hardcoded Slack and Telegram channels, then polls an Ethereum smart contract on the Sepolia test network for command-and-control information, deriving an AES key from an X25519 exchange to decrypt a second-stage payload stored in the contract, and can delete its files and strip the trigger to erase traces. Checkmarx attributes nine further packages to the operation and had them removed from npm, including btree-core (1,951,274 downloads), btree-leaderboard (493,685) and btree-range-store (468,092), and found a wallet holding 109 ETH, though the report does not say those funds came from cryptocurrency theft.

• Source article