AI-generated editorial illustration; not a documentary photograph.
A malware campaign targeting npm users reportedly bypassed npm v12's install-script protections by placing its loader inside the normal runtime behavior of the malicious indexed-btree package. BleepingComputer, citing Checkmarx researchers, says the package impersonated the legitimate sorted-btree library and reached 2 million weekly downloads.
Runtime Instead of Installation
The package avoids preinstall, install, and postinstall scripts, which are covered by GitHub's npm security measures announced in June 2026. Instead, its payload is reached through BTree.prototype.set() when an application supplies a specific key value. That means installation can appear clean while the package remains dangerous when application code runs.
What the Payload Does
According to Checkmarx, the runtime trigger loads an obfuscated first stage and collects system information including the host architecture, hostname, CPU, memory, and uptime. The data is sent through hardcoded Slack and Telegram channels. The malware also queries an Ethereum smart contract on the Sepolia test network for command-and-control information, using X25519 key exchange and AES to decrypt a second-stage payload.
A Wider Package Set
Checkmarx identified nine additional npm packages connected to the operation, including btree-core, which recorded 1,951,274 downloads, and several smaller packages with hundreds of thousands of downloads. The researchers said the operators made the project look legitimate with a populated GitHub history and a curated developer account. The report also linked the operation to a wallet holding 109 ETH, but did not establish that the funds came from cryptocurrency theft.
Implications for Developers
The campaign shows why install-time checks cannot cover every supply-chain threat. Developers who installed indexed-btree or one of the linked packages are advised to rotate secrets and restore affected environments from a known-safe backup. The source also reports that the nine additional packages were removed from npm, while recommending runtime behavioral analysis alongside installation scanning.
Source: Malicious npm packages evade install-script defenses at runtime
SIGNAL TITANS
Leave a Reply