Malicious npm btree packages hide loaders in runtime code, not install scripts

The campaign bypasses npm v12’s install-time checks and has already landed in projects via millions of downloads.

Checkmarx researchers uncovered a malicious npm package, `indexed-btree`, that imitates the legitimate `sorted-btree` library and has already reached about 2 million weekly downloads, along with nine related packages totaling hundreds of thousands of installs each. Instead of using blocked lifecycle scripts, the malware hides its loader in the package’s `BTree.prototype.set()` method so the payload activates only at runtime when called with a specific key, bypassing npm v12’s install‑time approval mechanisms and many static scanners. Once triggered, the code profiles the host (CPU, memory, architecture, hostname, uptime) and exfiltrates data via hardcoded Slack and Telegram channels, while using an Ethereum Sepolia smart contract plus X25519/AES to fetch and decrypt a second-stage payload. The malware can also clean up after itself by deleting its files and removing the trigger from the package code, making forensic investigation harder. Checkmarx and npm have removed the identified packages, and developers who installed them are urged to rotate all secrets, restore from clean backups, and add runtime behavioral monitoring rather than relying solely on install-time checks.