A new npm supply chain campaign demonstrates how threat actors are adapting to recent platform security measures by moving malicious code out of installation scripts and into a package’s everyday runtime behavior. Researchers at Checkmarx identified the malicious package ‘indexed-btree,’ which impersonates the legitimate ‘sorted-btree’ library and has racked up roughly 2 million weekly downloads.

Bypassing GitHub’s Latest Protections

In June 2026, GitHub introduced npm security controls intended to curb the wave of supply chain attacks that have hit open-source ecosystems since late 2025. A central feature blocks lifecycle scripts such as ‘preinstall,’ ‘install,’ and ‘postinstall’ unless explicitly approved, and it also restricts npm from silently fetching dependencies from Git repositories or remote URLs.

The indexed-btree package avoids these safeguards entirely. Instead of using an install script, its loader is embedded inside the library’s ‘BTree.prototype.set()’ method, a function nearly every consumer of the library would call routinely. Because the malicious code only fires at runtime rather than during installation, it triggers none of npm’s approval checks and evades standard taint-analysis and static-scanning tools.

Data Theft and Stealthy Command and Control

Once triggered, the malware collects system information such as architecture, hostname, CPU, memory, and uptime, and exfiltrates it via hardcoded Slack and Telegram channels. For command-and-control, it polls an Ethereum smart contract on the Sepolia test network, using X25519 key exchange to derive an AES key that decrypts a second-stage payload stored on-chain. Operators can remotely trigger a self-cleanup routine that deletes malware files and strips the malicious trigger from the package to erase evidence of compromise.

Checkmarx notes the attackers invested heavily in making the project look legitimate, building a convincing GitHub repository complete with a fabricated commit history and a curated developer account. The researchers also linked a wallet holding 109 ETH to the operation, though they did not confirm the funds originated from cryptocurrency theft.

Nine More Packages Removed

Checkmarx identified nine additional related packages, all now removed from npm, that collectively drew hundreds of thousands to nearly 2 million downloads each: ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, and sliding-score-window.

Recommendations

  • Do not rely solely on install-time scanning; incorporate runtime behavioral analysis into dependency vetting.
  • Developers who installed indexed-btree or any listed package should rotate all secrets immediately.
  • Restore affected development environments from a known-clean backup.