Malicious npm Package indexed-btree Bypasses Security via Runtime Code

A malicious npm package known as “indexed-btree” has been identified using runtime code to hide its malware loader, a tactic designed to bypass recent security enhancements in the Node Package Manager (npm) registry.

Researchers at Checkmarx discovered that the package, which mimics the legitimate “sorted-btree” utility, avoids using the preinstall or postinstall lifecycle scripts commonly used in supply chain attacks. This shift follows security changes in npm version 12, which were introduced to prevent the automatic execution of these scripts during installation.

Attackers Bypass Lifecycle Script Restrictions

Instead of relying on installation hooks, the malware hides its execution within existing application logic. Specifically, the loader is concealed inside a “BTree.prototype.set()” method. This trigger activates “sharedLoad.min.js”, a JavaScript payload that contains the first stage of the malware.

The malware is designed to fingerprint the host system and send details to a hard-coded Slack channel and a Telegram bot. It also utilises a technique known as “EtherHiding” to retrieve encrypted, second-stage payloads from a smart contract deployed on the Sepolia testnet. Once the payload is formed, the malware attempts to delete its malicious artefacts and remove the trigger from the package code to evade detection.

Financial Impact and Technical Execution

Statistics indicate the package amassed millions of downloads after its initial upload on 18 June 2026. The campaign is believed to have generated significant illicit profits, estimated at approximately €230,933.57 (roughly 109 ETH) in cryptocurrency.

Several other packages were identified as part of the same operation, including “ordered-kv-index”, “btree-leaderboard”, “priority-slot-queue”, and “btree-core”. These have since been removed from the npm registry.

Ensar Seker, CISO at SOCRadar, noted that the campaign demonstrates how attackers adapt almost immediately to stronger software supply chain defences. Seker suggested that while blocking lifecycle scripts is an important step, defenders must implement layered controls that include runtime behaviour analysis to detect malicious activity during execution.