A malicious npm package, indexed-btree, has been removed from the public registry after being used in a supply chain attack that exposed sensitive data. The package was downloaded over 1.5 million times before its removal, putting many developers and organizations at risk of identity exposure.
Indexed-btree masqueraded as a legitimate database indexing library, but it contained a hidden loader that executed malicious code during runtime. This allowed the attacker to inject additional malicious packages into the affected projects, potentially leading to further exploitation. The package’s functionality was designed to make it nearly undetectable, even for developers who closely reviewed its code.
The npm package ecosystem relies on users and contributors to report suspicious activity. However, in this case, the indexed-btree package had been around since 2019 without raising any red flags. Its malicious behavior went unnoticed until a security researcher discovered it by analyzing the package’s dependencies. The researcher found that the loader was injected through a series of complex code transformations, making it difficult to identify as malicious.
Indexed-btree was not an isolated incident. According to recent research, thousands of npm packages may be vulnerable to similar attacks due to lax security measures in place. This highlights the need for developers and organizations to prioritize package auditing and dependency management. It also underscores the importance of transparency within the software development community. Developers should strive to create secure code that can withstand scrutiny, rather than relying on users to detect potential vulnerabilities.
While indexed-btree has been removed from npm’s registry, affected projects are still at risk if they have not updated their dependencies since the malicious package was installed. To mitigate this threat, developers and organizations should review their project dependencies regularly for signs of tampering or suspicious behavior. They can also use tools like Snyk to scan their code for potential vulnerabilities.
As a developer, it is essential to understand that a single vulnerable package can have far-reaching consequences. This incident serves as a reminder to prioritize security in every aspect of software development and deployment. By staying vigilant and proactive, developers can minimize the risk of supply chain attacks like the one caused by indexed-btree.
Source: The Hacker News — 2026-09-22