GoKawiilFake npm package 'indexed-btree' hides malware in runtime code, not install scripts
Checkmarx researchers uncovered a malicious npm package called 'indexed-btree,' which mimics the legitimate 'sorted-btree' library and has racked up 2 million weekly downloads. Rather than embedding malicious code in install scripts—now restricted by npm's June 2026 security measures—the attackers hid a malware loader inside the package's commonly used BTree.prototype.set() method, which activates only when called with a specific key. Once triggered, the malware gathers system data such as hostname, CPU, memory, and uptime, and sends it to attackers who reportedly control a wallet holding 109 ETH, though its link to this campaign is unconfirmed.
GoKawiil's interpretation of the reporting above, not reported fact.
This case reveals a significant blind spot in npm's newest anti-supply-chain-attack defenses, which mainly target install-time scripts and remote dependency fetching. By embedding malicious logic in normal runtime functions, attackers can evade static analysis and taint-tracking tools that assume install scripts are the main threat vector. It signals that open-source security tooling must evolve to inspect runtime behavior, not just installation processes, as supply chain attacks grow more sophisticated.
- The 'indexed-btree' npm package impersonates 'sorted-btree' and has 2 million weekly downloads.
- Its malware loader activates through a normal runtime method, bypassing npm's install-script security checks introduced in June 2026.
- The malware collects system information and may be tied to an attacker wallet holding 109 ETH, though the source of those funds is unclear.
YubiKey 5C NFC Security Key — Supply chain attacks like this npm malware campaign often start with compromised developer credentials or npm publishing accounts. A hardware security key like the YubiKey adds phishing-resistant two-factor authentication to your npm and GitHub accounts, making it much harder for attackers to hijack your packages or push malicious updates.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-20
Published there as: “Malicious npm packages evade install-script defenses at runtime”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.