A malicious npm package named indexed-btree has been removed from the npm registry after security researchers discovered that it concealed malware within application runtime code instead of relying on traditional installation scripts. Security firm Checkmarx reported that the package imitated the legitimate sorted-btree package, a utility commonly used for B-tree indexing operations, while embedding malicious functionality inside the library itself. The discovery highlights how attackers are adapting their approaches after recent security improvements in package ecosystems, including npm version 12 changes that restrict automatic execution of lifecycle scripts such as preinstall and postinstall. Unlike many previous supply chain attacks that relied on installation hooks to execute malicious code, indexed-btree operated through normal application execution after developers integrated the package into their projects. Checkmarx said the package and its related GitHub repository are no longer available for download. According to available package statistics, indexed-btree was first published on June 18, 2026, by an npm account named “charlessadler25” and accumulated millions of downloads before removal.
Researchers said the malicious functionality was hidden inside the BTree.prototype.set() method, where it triggered a loader file named sharedLoad.min.js. The JavaScript payload contained an obfuscated first stage of the malware designed to collect information about the affected system and send collected details to attacker-controlled communication channels, including a hard-coded Slack channel and Telegram bot. The malware also used a technique known as EtherHiding, which involves retrieving encrypted next-stage payloads from blockchain-based smart contracts. In this case, the payloads were obtained from a smart contract deployed on the Sepolia testnet before being combined to create the next stage of the infection process. Researchers said the final stage attempted to remove malicious files and eliminate execution triggers from the package code in an effort to reduce traces of the activity. Checkmarx identified indexed-btree as part of a broader group of related npm packages connected to the same campaign, including ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, sliding-score-window, and mutex-forge, all of which have since been removed from npm.
Security researchers warned that the incident demonstrates why package security strategies cannot rely only on blocking installation scripts or performing checks before installation. While npm’s lifecycle script restrictions reduce one common method used to execute malicious code, attackers can shift their techniques by embedding harmful functionality into legitimate-looking application code. Ensar Seker, CISO at SOCRadar, said the campaign shows that security controls can influence attacker behavior but do not eliminate software supply chain risks. Researchers recommend combining package scanning with runtime behavior monitoring, dependency analysis, and security checks throughout the software development lifecycle. These additional controls can help identify suspicious activity that may only become visible when a package is actively executed within an application environment.
The disclosure also coincides with findings from Socket regarding another software supply chain campaign involving Packagist package visanduma/nova-two-factor. Socket reported that malicious code was removed from the package’s dev-main version as part of an ongoing campaign researchers have linked to North Korea. According to Socket, the activity involved compromised developer accounts and source repositories, where malicious content was introduced into projects and triggered through normal developer actions such as cloning repositories or opening them in integrated development environments. Researchers said the campaign involved techniques such as rewriting Git history, hiding payloads inside configuration or font files, creating malicious VS Code auto-run tasks, and using blockchain-based methods such as EtherHiding and NullReceiver for staged payload delivery. Socket researcher Karlo Zanki said analysis of the Visanduma GitHub organization indicated repository compromises since mid-June 2026 through the LaHiRu developer account. Researchers also observed newer techniques involving heavily obfuscated JavaScript inserted into index.php files and executed through PHP’s shell_exec() function. The findings reinforce concerns around software supply chain security, where compromised repositories can provide attackers with opportunities to reach developer environments, access private projects, and spread malicious changes through normal development workflows.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
