An ongoing npm supply-chain malware campaign centered on the ‘indexed-btree’ package demonstrates how threat actors bypass modern package manager defenses by hiding malicious code inside standard runtime operations rather than installation scripts.
Discovered by Checkmarx researchers, the malicious package masquerades as the legitimate ‘sorted-btree’ library and has accumulated approximately 2 million weekly downloads. The wider operation has also generated significant cryptocurrency activity, linked to a wallet holding 109 ETH, though investigators have not confirmed whether those specific funds originated from theft.
The campaign effectively evades security controls introduced in June 2026, when GitHub deployed updated npm security measures designed to block lifecycle scripts such as ‘preinstall’, ‘install’, and ‘postinstall’ unless explicitly approved by administrators. Furthermore, these controls prevent npm from automatically pulling dependencies from remote URLs or Git repositories without direct authorization.
To circumvent these restrictions, the ‘indexed-btree’ package avoids installation scripts entirely. Instead, it embeds its loader directly into the library’s BTree.prototype.set method, which executes during normal application runtime whenever a user calls the function with a specific key value. As a result, the package installation appears completely clean and bypasses npm v12 approval mechanisms.
“The malware loader hides inside the library’s own BTree.prototype.set method, which is the main function that every user would call constantly,” explains Checkmarx. “This triggers the sharedLoad.min.js, which contains the obfuscated first stage of the malware. This is a well-built way to sneak past standard taint-analysis tools and most static scanners.”
Once triggered, the malware gathers detailed system telemetry, including architecture, hostname, CPU specifications, memory metrics, and uptime statistics. It exfiltrates this data via hardcoded Slack and Telegram channels. For command-and-control operations, the payload polls an Ethereum smart contract hosted on the Sepolia test network, utilizing an X25519 key exchange to derive an AES key that decrypts a secondary payload stored within the contract.
To maintain credibility, the threat actors constructed a polished GitHub repository complete with populated commit history and curated developer accounts. Checkmarx identified nine additional malicious npm packages tied to the same campaign, including ‘btree-core’, ‘btree-range-store’, ‘btree-leaderboard’, ‘ordered-kv-index’, ‘priority-slot-queue’, ‘btree-time-index’, ‘btree-lru-cache’, ‘neighbor-key-map’, and ‘sliding-score-window’, all of which have since been removed from the registry.