A new npm malware campaign has successfully bypassed recent supply chain security measures by embedding malicious code within a package's normal runtime behavior rather than in installation scripts. The campaign, identified by Checkmarx researchers, involves the `indexed-btree` package, which has accumulated two million weekly downloads, and several other related packages.
The `indexed-btree` package mimics the legitimate `sorted-btree` library. Its malicious functionality is not triggered during installation, allowing it to evade security checks introduced by GitHub in June 2026. These measures block dependency lifecycle scripts like `preinstall`, `install`, and `postinstall` unless explicitly approved, and prevent automatic retrieval of dependencies from Git repositories or remote URLs.
Instead of using installation scripts, the malware loader is hidden within the `BTree.prototype.set()` method of the `indexed-btree` package. This method is a core function that would be frequently called by users of the library. When invoked with a specific key value, it triggers `sharedLoad.min.js`, which contains the obfuscated first stage of the malware. This technique allows the malicious code to bypass standard taint-analysis tools and most static scanners.
Upon execution, the malware gathers system details such as architecture, hostname, CPU, memory, and uptime. This information is then exfiltrated via hardcoded Slack and Telegram channels. The malware also communicates with an Ethereum smart contract on the Sepolia test network to receive command-and-control (C2) instructions. It uses X25519 key exchange to derive an AES key, which decrypts a second-stage payload stored in the contract. Operators can also command the malware to delete its files and remove the malicious trigger from the package code to erase its traces.
The threat actors went to considerable lengths to make the `indexed-btree` project appear legitimate. This included creating a convincing GitHub repository, populating it with a fabricated commit history, and curating the developer account.
Checkmarx researchers also identified nine other npm packages linked to the same operation, which have since been removed from npm. These packages also achieved significant download numbers: `ordered-kv-index` (448,184 downloads), `btree-leaderboard` (493,685 downloads), `priority-slot-queue` (402,860 downloads), `btree-range-store` (468,092 downloads), `btree-core` (1,951,274 downloads), `btree-time-index` (425,312 downloads), `btree-lru-cache` (372,185 downloads), `neighbor-key-map` (366,019 downloads), and `sliding-score-window` (448,024 downloads).
The researchers noted that the attackers may have generated significant profits, pointing to an Ethereum wallet holding 109 ETH. However, it is not confirmed that these funds were acquired through cryptocurrency theft.
Developers are advised to move beyond relying solely on install-time scanning and to implement runtime behavioral analysis for enhanced security. Users who have installed `indexed-btree` or any of the other listed malicious packages should rotate all secrets and restore their development environments from a trusted backup.
