npm Malware Hides in Runtime Code to Bypass New Security Defenses
A malicious npm package named 'indexed-btree' demonstrates a new technique for bypassing npm supply chain defenses by hiding malware in a package's normal runtime behavior rather than in installation scripts. Discovered by Checkmarx researchers, the package impersonates the legitimate 'sorted-btree' library and has already accumulated 2 million weekly downloads. The attackers appear to operate a wallet holding 109 ETH, though the report does not confirm whether those funds come from cryptocurrency theft.
The campaign sidesteps security measures that GitHub introduces in June 2026, which block dependency lifecycle scripts such as 'preinstall', 'install', and 'postinstall' unless explicitly approved. Instead of using installation scripts, the malicious package hides its loader inside the BTree.prototype.set() method, a core function that users call constantly. The malware only triggers when the method receives a specific key value, launching an obfuscated first stage from a file called sharedLoad.min.js. This approach allows the installation to appear clean and avoids npm v12's approval mechanisms, standard taint-analysis tools, and most static scanners.
Once activated, the malware collects system details such as architecture, hostname, CPU, memory, and uptime, and exfiltrates the data through hardcoded Slack and Telegram channels. It also polls an Ethereum smart contract on the Sepolia test network for command-and-control information, using X25519 key exchange to derive an AES key that decrypts a second-stage payload stored in the contract. When the operators decide to end the attack, the malware deletes its files and removes the malicious trigger from the package to cover its tracks.