Malicious npm Packages Bypass Install-Script Defenses at Runtime

Post Views: 1

A cybersecurity investigation has uncovered a sophisticated campaign involving the ‘indexed-btree’ npm package, which exploits runtime execution to bypass modern supply chain security measures.

Cybersecurity Investigation Unveils Malicious npm Campaign

Researchers from Checkmarx identified the malicious package, which mimics the legitimate ‘sorted-btree’ library and has accumulated over 2 million weekly downloads.

Technical Approach and Runtime Execution

The campaign’s technical approach involves embedding a loader within the BTree.prototype.set() method, a function frequently invoked during application execution. This method executes when a specific key value is called, allowing the malware to activate without triggering npm’s security mechanisms.

Evasion of Security Mechanisms

These mechanisms, introduced in June 2026, block dependency lifecycle scripts such as ‘preinstall’, ‘install’, and ‘postinstall’ unless explicitly authorized. By avoiding these scripts, the package appears benign during installation, evading detection by static analysis tools and taint scanners.

Data Collection and Command-and-Control

Once executed, the malware gathers system-level data, including architecture, hostname, CPU details, memory configuration, and uptime. This information is transmitted to hardcoded Slack and Telegram channels. The malware also interacts with an Ethereum smart contract on the Sepolia test network to retrieve command-and-control (C2) instructions.

Interaction with Ethereum Smart Contract

Using the X25519 key exchange protocol, it generates an AES key to decrypt a second-stage payload stored within the contract. Attackers can terminate the operation by deleting the malicious files and removing the runtime trigger from the package’s code, leaving minimal traces.

Cleanup and Credibility Efforts

Checkmarx researchers noted the threat actors’ efforts to establish credibility, including creating a GitHub repository with a fabricated commit history and curating a legitimate-looking developer profile.

Related Packages and Security Advice

Nine additional npm packages linked to the same operation were also identified and removed. These included ‘ordered-kv-index’, ‘btree-leaderboard’, ‘priority-slot-queue’, ‘btree-range-store’, ‘btree-core’, ‘btree-time-index’, ‘btree-lru-cache’, ‘neighbor-key-map’, and ‘sliding-score-window’, each with download counts ranging from 366,019 to 1.95 million. Security experts advise developers to supplement install-time scanning with runtime behavioral analysis to detect such threats. Organizations that have installed ‘indexed-btree’ or the related packages are urged to rotate all sensitive credentials and restore their environments from verified backups.

Financial Motives and Conclusion

The incident underscores the evolving nature of supply chain attacks, where adversaries exploit trusted ecosystems to deploy stealthy malware. The campaign’s financial motives remain unclear, though researchers observed a cryptocurrency wallet containing 109 ETH. However, no direct evidence of theft was confirmed. The attack demonstrates the need for continuous monitoring and adaptive security strategies to counter increasingly sophisticated threats.