A coordinated npm malware operation leveraging the indexed-btree package demonstrates how attackers can circumvent newly deployed supply chain protections by embedding payload logic into a package's normal runtime execution path instead of relying on installation-time scripts. Checkmarx security researchers identified the campaign, which masquerades as the legitimate sorted-btree library and has accumulated 2 million downloads per week.
The attackers behind the operation maintain a cryptocurrency wallet containing 109 ETH, according to Checkmarx's analysis, though the report does not confirm whether those holdings originated from the malware campaign itself.
Circumventing npm's latest protections
GitHub rolled out npm security improvements in June 2026 aimed at mitigating supply chain attacks that have repeatedly compromised open-source software since late 2025. The measures include blocking dependency lifecycle scripts—preinstall, install, and postinstall—unless developers explicitly authorize them, and preventing npm from automatically pulling dependencies from Git repositories or remote URLs without permission.
The malicious indexed-btree package sidesteps these controls entirely by avoiding installation scripts altogether. Instead, the attackers embedded their loader code within the package's BTree.prototype.set() method, which activates at runtime when an application invokes it using a particular key value. This approach allows the installation process to appear benign and triggers no approval mechanisms in npm v12.
The malware loader hides inside the library's own BTree.prototype.set method, which is the main function that every user would call constantly. This triggers the sharedLoad.min.js, which contains the obfuscated first stage of the malware. This is a well-built way to sneak past standard taint-analysis tools and most static scanners.
Checkmarx
Malware capabilities and operational infrastructure
Upon execution, the malware gathers system metadata including processor architecture, hostname, CPU specifications, memory capacity, and system uptime, then transmits this information through hardcoded Slack and Telegram communication channels. The payload also queries an Ethereum smart contract deployed on the Sepolia test network to retrieve command-and-control instructions. The malware employs X25519 key exchange to establish an AES encryption key and decrypt a secondary-stage payload stored within the contract.
The attackers designed the malware to support operational cleanup: when they decide to terminate the campaign, the code can remove its own files and strip the malicious trigger from the package source to eliminate forensic evidence.
Campaign scope and attribution efforts
The threat actors invested significant effort in making their operation appear legitimate. They constructed a convincing GitHub repository, seeded it with a realistic commit history, and developed a credible developer profile to lend authenticity to the project.
Checkmarx identified nine additional npm packages connected to the same operation, all of which have since been removed from the registry. These packages collectively achieved substantial download volumes:
- ordered-kv-index (448,184 downloads)
- btree-leaderboard (493,685 downloads)
- priority-slot-queue (402,860 downloads)
- btree-range-store (468,092 downloads)
- btree-core (1,951,274 downloads)
- btree-time-index (425,312 downloads)
- btree-lru-cache (372,185 downloads)
- neighbor-key-map (366,019 downloads)
- sliding-score-window (448,024 downloads)
Recommendations for developers
Security researchers advise development teams against relying exclusively on installation-time package scanning. Organizations should implement runtime behavioral analysis as a complementary detection layer.
Anyone who installed indexed-btree or any of the identified packages should immediately rotate all stored credentials and secrets, then rebuild their development environment from a known-clean backup.