Malicious npm package hides malware in runtime code

BleepingComputer reports that the npm package indexed-btree is part of an ongoing malware campaign that bypasses installation-script defenses. The package imitates the legitimate sorted-btree library and has reached 2 million weekly downloads. According to Checkmarx, a wallet linked to the operation holds 109 ETH, although the report does not say the funds came from cryptocurrency theft.

In June 2026, GitHub announced npm security measures that block dependency lifecycle scripts such as preinstall, install, and postinstall unless explicitly approved. Other controls prevent automatic dependency retrieval from Git repositories or remote URLs without permission.

The malicious package avoids those controls by placing its loader in the BTree.prototype.set() method, which runs when an application calls it with a specific key. This allows installation to appear clean and avoids npm v12 approval mechanisms. Checkmarx said the method triggers sharedLoad.min.js, an obfuscated first stage designed to evade static scanners and taint-analysis tools.

After execution, the malware can collect architecture, hostname, CPU, memory, and uptime details, then exfiltrate them through hardcoded Slack and Telegram channels. It also polls an Ethereum smart contract on the Sepolia test network for command-and-control data, using X25519 to derive an AES key for a second-stage payload.

Checkmarx linked nine additional npm packages to the operation and said npm removed them. Researchers said the operators created a convincing GitHub repository and developer account, and that install-time scanning alone may not detect the campaign.