Malicious NPM Package Mimicking B-tree Utility Reaches Millions of Downloads

A sophisticated supply chain attack targeting the NPM ecosystem has been identified, involving a malicious package named indexed-btree that has accumulated millions of downloads. Researchers at Checkmarx discovered that the package mimics the legitimate sorted-btree utility to build trust among developers.

The threat actor employed a highly effective method to bypass traditional security scanners. Instead of using common malicious install scripts, which are often flagged by automated security solutions, the attacker embedded a malware trigger within the library’s JavaScript prototype code. Specifically, the malicious payload is hidden inside the BTree.prototype.set method.

To increase the package’s perceived legitimacy, the attacker created a dedicated GitHub repository and added seemingly routine commits. This strategy helped the package reach two million weekly downloads before its malicious nature was detected.

Blockchain-Based Command and Control

Once the malicious code is executed, it performs several stages of data exfiltration and command-and-control (C&C) communication. The malware first collects system information and sends it to hardcoded Slack and Telegram channels. It then connects to a smart contract deployed on the Sepolia blockchain, which serves as its C&C infrastructure.

The malware uses this blockchain connection to extract and decrypt a second-stage payload. After completing its objectives, the code attempts to clean its own traces from the host system to avoid detection.

Checkmarx noted that the attacker’s smart contract had previously been linked to the mutex-forge package. The threat actor is estimated to have gained approximately 109 ETH, valued at nearly $300,000, through these campaigns.

Wider Supply Chain Impact

The indexed-btree package is part of a larger, ongoing campaign. Several other malicious packages have been linked to the same threat actor, including:

• ordered-kv-index
• btree-leaderboard
• priority-slot-queue
• btree-range-store
• btree-core
• btree-time-index
• btree-lru-cache
• neighbor-key-map
• sliding-score-window

These related packages had accumulated over five million downloads before being removed from the ecosystem. Security professionals are advised to audit their dependency trees and monitor for any unexpected prototype-based code execution in JavaScript environments.