Security researchers have identified an npm malware operation that avoids newer install-time protections by placing its malicious functionality inside ordinary package code that runs only after an application begins using the library.
The campaign centers on a package called indexed-btree, which researchers at Checkmarx said was designed to resemble the legitimate sorted-btree project. The package reportedly accumulated roughly 2 million weekly downloads before its removal or investigation, illustrating the potential reach of typosquatting and lookalike dependencies in software supply chains.
Runtime trigger avoids lifecycle-script controls
Recent npm security controls restrict dependency lifecycle scripts, including preinstall, install and postinstall hooks, unless users explicitly approve them. Those measures are intended to reduce the risk of malicious code executing as soon as a package is installed.
According to Checkmarx, the malicious package did not use those hooks. Instead, its loader was embedded in the library's BTree.prototype.set() function. The code is activated during normal runtime activity when the method is called with a particular key, allowing the package to appear benign during installation and potentially avoiding scanners focused on lifecycle scripts.
Once activated, the malware can gather device and system information, such as the hostname, processor architecture, memory, uptime and CPU details. Researchers said the data could be sent through hardcoded Slack and Telegram infrastructure.
The payload also reportedly uses an Ethereum Sepolia testnet smart contract as part of its command-and-control process. It retrieves information needed to derive an encryption key, then decrypts a later-stage payload. Checkmarx said the malware includes cleanup capabilities that can delete files and remove the injected trigger when operators decide to end an operation.
Broader package cluster identified
Researchers linked nine additional npm packages to the same activity, including btree-core, ordered-kv-index, btree-leaderboard, priority-slot-queue, and btree-range-store. Several had substantial download counts. The operation also used a polished GitHub presence, including a curated developer profile and apparently fabricated commit history, to reinforce its legitimacy.
Developers should review dependency inventories for the identified package names, rotate potentially exposed credentials, and rebuild affected development environments from trusted backups where appropriate. The incident also underscores the need for behavioral monitoring and code review beyond installation-time scanning alone.