A Stealthy Malware Campaign Exploits npm Supply Chain with Ease
Threat actors have been exploiting vulnerabilities in the npm package ecosystem, evading even the latest security measures by hiding malicious code within a package’s normal runtime behavior. The campaign, which has already amassed 2 million weekly downloads for its malicious package, “indexed-btree,” is a stark reminder of the ongoing cat-and-mouse game between attackers and defenders.
The indexed-btree package, discovered by Checkmarx researchers, impersonates the legitimate ‘sorted-btree’ library and has been downloaded millions of times. What’s more concerning is that it manages to bypass the security measures put in place by npm after a series of high-profile supply chain attacks in late 2025. These measures included blocking dependency lifecycle scripts unless explicitly approved and preventing npm from automatically retrieving dependencies from Git repositories or remote URLs without permission.
So, how does indexed-btree evade these defenses? By hiding its loader within the package’s BTree.prototype.set() method, which executes at runtime when the application calls it with a specific key value. This clever tactic means that installation appears clean and triggers none of npm v12’s approval mechanisms. In other words, the malware loader blends seamlessly into the legitimate code, making it nearly undetectable.
Once executed, the malware collects system details, including architecture, hostname, CPU, memory, and uptime, and exfiltrates this information through hardcoded Slack and Telegram channels. It also polls an Ethereum smart contract on the Sepolia test network for command-and-control (C2) information using a sophisticated key exchange mechanism.
The threat actors have gone to great lengths to make their project appear legitimate, including building a convincing GitHub repository with a commit history and developer account. In fact, Checkmarx discovered nine additional npm packages linked to this operation, which they have now removed from the registry. These packages also achieved significant download numbers, highlighting the scope of this campaign.
The takeaway for developers is clear: relying on install-time scanning alone is not enough. Runtime behavioral analysis must be employed to detect and prevent such attacks. If you’ve installed indexed-btree or any of the listed packages, it’s essential to rotate all secrets and restore your development environment from a safe backup.
This incident underscores the ongoing challenge of securing open-source ecosystems and the need for continued vigilance among developers. As AI-powered attacks become increasingly sophisticated, defenders must adapt their strategies to stay ahead of the curve.
Source: Bleeping Computer — 2026-09-20