NPM Package 'indexed-btree' Hides Malware in Runtime Function to Bypass New Security Controls

A malicious npm package named 'indexed-btree' impersonates the legitimate 'sorted-btree' library and has gained 2 million weekly downloads. Instead of using installation scripts, it embeds a loader in the BTree.prototype.set method, which executes when the application calls it with a specific key, evading GitHub's June 2026 security measures. The malware collects system information, exfiltrates it via Slack and Telegram, and uses an Ethereum smart contract for command-and-control, with the attackers holding 109 ETH.

The package's loader sits inside BTree.prototype.set, a method developers call constantly when using the library, which lets it bypass static scanners and taint-analysis tools. Once triggered, the malware gathers system details—architecture, hostname, CPU, memory, and uptime—and exfiltrates them through hardcoded Slack and Telegram channels. Command-and-control runs through an Ethereum smart contract on the Sepolia test network, using X25519 key exchange to derive an AES key for decrypting a second-stage payload.

Checkmarx linked nine additional packages to the same operation, collectively amassing millions of downloads, including btree-core at nearly 2 million. The attackers fabricated a convincing GitHub repository with a populated commit history and curated developer account. When ending an attack, the malware deletes its files and removes the trigger to erase traces. The wallet holds 109 ETH, though the report does not confirm those funds came from theft.