{"id":3051,"date":"2026-09-22T10:54:40","date_gmt":"2026-09-22T10:54:40","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3051"},"modified":"2026-09-22T10:54:40","modified_gmt":"2026-09-22T10:54:40","slug":"malicious-npm-package-indexed-btree-hid-its-loader-in-runtime-code-before-removal","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3051","title":{"rendered":"Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal"},"content":{"rendered":"
\n
<\/a><\/div>\n

A malicious npm package named \u00abindexed-btree\u00bb has been observed hiding its malicious behavior within application code rather than using lifecycle scripts, indicating that threat actors are likely shifting tactics in response to recent security controls.<\/p>\n

\u00abIndexed-btree is a malicious npm package mimicking the legit sorted-btree package, an ordinary B-tree\/indexing utility,\u00bb Checkmarx said<\/a>. \u00abUnlike the common attacks we’ve seen in the supply chain space, this package does not rely on preinstall \/ postinstall at all. Instead, it runs entirely from application code at runtime.\u00bb<\/p>\n

The package<\/a> and the associated GitHub repository<\/a> are no longer available for download from npm. However, statistics show the package was first uploaded to the registry on June 18, 2026, by an npm user named \u00abcharlessadler25<\/a>,\u00bb amassing millions of downloads<\/a> in a short span of time<\/a>.<\/p>\n

To make matters worse, the campaign may have generated illicit profits for the threat actor, earning them around \u20ac230,933.57 in cryptocurrency (i.e., 109 ETH).<\/p>\n

The development comes as npm version 12 introduced a security change to prevent automatic execution of lifecycle scripts such as preinstall or postinstall, which is one of the most common ways malware is executed through packages distributed through the repository.<\/p>\n

\u00abLegitimately, these are often used for compiling necessary code, seeding data, or setting up essential configurations,\u00bb Checkmarx said<\/a>. \u00abFor threat actors, however, this is frequently exploited to automatically execute malicious code without user consent during the installation of a malicious package.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The latest findings from the software supply chain security company show that bad actors are shifting tactics in response to the change, eschewing install hooks in favor of incorporating the malicious code directly within the library.<\/p>\n

In this case, the malware loader is concealed inside a \u00abBTree.prototype.set()\u00bb method, which then triggers \u00absharedLoad.min.js,\u00bb a JavaScript payload that embeds the obfuscated first stage of the malware.<\/p>\n

The malware is designed to fingerprint the host, beacon the details to a hard-coded Slack channel and Telegram bot, uses the EtherHiding technique to pull next-stage, encrypted blobs from a smart contract<\/a> deployed on Sepolia testnet, and finally merge them to form the second-stage payload.<\/p>\n

\"\"<\/a><\/div>\n

The final step involves deleting the malicious artifacts and removing the trigger from the package code to cover up the tracks.<\/p>\n

Checkmarx said indexed-btree is one of the many npm packages tied to the same operation, all of which have since been removed from npm –<\/p>\n