GoKawiilFake npm package 'indexed-btree' hides malware in runtime code, not install scripts
Checkmarx researchers uncovered a malicious npm package called 'indexed-btree,' which mimics the legitimate 'sorted-btree' library and has racked up 2 million weekly downloads. Rather than embedding malicious code in install scripts—now restricted by npm's June 2026 security measures—the attackers hid a malware loader inside the package's commonly used BTree.prototype.set() method, which activates only when called with a specific key. Once triggered, the malware gathers system data such as hostname, CPU, memory, and uptime, and sends it to attackers who reportedly control a wallet holding 109 ETH, though its link to this campaign is unconfirmed.