Malicious npm package indexed-btree fires its loader from a runtime library call
Checkmarx says a fake sorted-btree clone reached 2 million weekly downloads with clean install scripts, starting its loader only when an application calls BTree.prototype.set with a particular key. Nine related packages have been pulled.
The Watch · Security desk
What happened
- Checkmarx found indexed-btree, an npm package impersonating the legitimate sorted-btree library, which had reached 2 million weekly downloads by the time it was flagged.
- The package has no installation scripts, so the install looks clean and none of npm v12's approval mechanisms fire at any point during it.
- GitHub's June 2026 npm measures block preinstall, install and postinstall scripts unless approved, and stop npm pulling dependencies from Git repositories or remote URLs without permission.
- Once running, the malware profiles the host and exfiltrates over hardcoded Slack and Telegram channels, then polls an Ethereum smart contract on the Sepolia test network for its second stage.
Why it matters
- What it limits constraint Detection for this package class has to come from something watching the application while it runs; install-time gating is the wrong place to look for it.
- What it costs cost Anyone who pulled one of the ten packages pays for remediation in rotated secrets and development environments restored from backup.
- What's now possible capability Reviewing the installed package after an alert is no longer a dependable check, because the operators can strip the trigger out of the code on command.
- What doesn't add up contradiction Checkmarx's recommended fix is runtime behavioral analysis, yet the loader it describes fires only on a specific key value. That single trigger bounds what a sandbox run will ever observe.
Next story · Security · Oct 6
Malicious indexed-btree package moves npm malware from install scripts to first useConfirmed2 publishers
BTree.prototype.set() is the write path of a sorted-map library, so an application that uses indexed-btree calls it repeatedly. Checkmarx says the loader sits inside that method and fires when the caller passes a specific key value [3]. "The malware loader hides inside the library's own BTree.prototype.set method, which is the main function that every user would call constantly," Checkmarx said [5]. The firm called the approach "a well-built way to sneak past standard taint-analysis tools and most static scanners" [6].
GitHub built the June 2026 npm controls after repeated supply-chain attacks on open-source ecosystems since late 2025 [17]. They work against install-script malware, and indexed-btree does not need an install script, so npm v12's approval flow has nothing to approve [3][4].
Checkmarx advises developers to stop relying on install-time scanning alone and to add runtime behavioral analysis [14]. That buys partial coverage: the loader waits on a specific key value, so a sandbox that imports the package and exercises it will watch ordinary btree operations unless the key it writes happens to match [3].
indexed-btree stood at 2 million weekly downloads when Checkmarx flagged it [2]. The nine related packages Checkmarx had removed from npm [21] add up to 5,375,635 downloads between them, with btree-core accounting for 1,951,274 of that [13][18]. BleepingComputer did not say what period its figures for the nine cover [16]. Six of the ten package names contain the string btree [19]. A dependency-tree search on that string covers most of the set.
Checkmarx says the operators built a legitimate-looking GitHub repository, populated its commit history and curated the developer account [12]. The firm also ties a wallet holding 109 ETH to the operation, without attributing those funds to cryptocurrency theft in the report [20].
What to watch
- Whether Checkmarx or GitHub publishes the trigger key values. With them, teams could check their own call sites instead of guessing.
- Whether npm adds an enforced runtime or publish-time behavioral signal, or leaves the lifecycle-script approval gate as the only control.
- Whether the same operator returns with new packages seeded through another curated GitHub account and commit history.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption45
- Hype gap+20
- Incentives45
- Confidence60
Perspective Coverage
3 publishers- Builder
- Builder 43%
- Operator
- Operator 45%
- Investor
- Investor 12%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Checkmarx researchers spotted the 'indexed-btree' npm package, part of an ongoing npm malware campaign that hides malicious code in a package's normal runtime behavior instead of installation scripts.
- [2]
indexed-btree attempts to impersonate the legitimate 'sorted-btree' library and has already amassed 2 million weekly downloads.
- [3]
The malicious indexed-btree package avoids installation scripts and instead hides its loader in the package's BTree.prototype.set() method, which executes at runtime when the application calls it with a specific key value.
- [4]
As a result, installation appears clean and triggers none of npm v12's approval mechanisms.
- [5]
"The malware loader hides inside the library's own BTree.prototype.set method, which is the main function that every user would call constantly," Checkmarx said.
- [6]
Checkmarx said the loader "triggers the sharedLoad.min.js, which contains the obfuscated first stage of the malware. This is a well-built way to sneak past standard taint-analysis tools and most static scanners."
- [7]
Once executed, the malware can collect system details including architecture, hostname, CPU, memory and uptime, and exfiltrate the information through hardcoded Slack and Telegram channels.
- [8]
The malware polls an Ethereum smart contract on the Sepolia test network for command-and-control information, using X25519 key exchange to derive an AES key and decrypt a second-stage payload stored in the contract.
- [9]
When the operators choose to end the attack, the malware can delete its files and remove the malicious trigger from the package code to wipe its traces.
- [10]
In June 2026 GitHub announced a set of npm security measures, one of which blocks dependency lifecycle scripts such as 'preinstall', 'install' and 'postinstall' unless explicitly approved.
- [11]
Other GitHub measures prevent npm from automatically retrieving dependencies from Git repositories or remote URLs without permission.
- [12]
The threat actors made the project appear legitimate by building a legitimate-looking GitHub repository, populating its commit history and curating the developer account.
- [13]
Download counts for the nine removed packages: ordered-kv-index 448,184; btree-leaderboard 493,685; priority-slot-queue 402,860; btree-range-store 468,092; btree-core 1,951,274; btree-time-index 425,312; btree-lru-cache 372,185; neighbor-key-map 366,019; sliding-score-window 448,024.
- [14]
Developers are advised not to rely on install-time scanning alone and to also employ runtime behavioral analysis.
- [15]
Those who installed indexed-btree or any of the nine listed packages should rotate all secrets and restore their development environment from a safe backup.
- [16]
BleepingComputer lists the nine removed packages' download figures without stating the period those figures cover, while indexed-btree's 2 million figure is given as weekly.
- [17]
GitHub's June 2026 npm security measures were designed to help prevent supply chain attacks that have shaken open-source ecosystems repeatedly since late 2025.
- [18]
The nine removed packages account for 5,375,635 downloads between them.
- [19]
Six of the ten package names tied to the operation contain the string 'btree'.
- [20]
According to Checkmarx the attackers use a wallet holding 109 ETH; the report does not say those funds came from cryptocurrency theft.
- [21]
Checkmarx discovered nine additional npm packages linked to the same operation and has now had them removed from npm.
- [22]
Ten packages in total are tied to the operation: indexed-btree plus the nine Checkmarx had removed.
Sources
3 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comMalicious npm packages evade install-script defenses at runtime
1 article · September 20, 2026
- securityweek.comMalicious B-tree NPM Package Accumulates Millions of Downloads
1 article · September 22, 2026
- thehackernews.comMalicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal
1 article · September 22, 2026