Malicious npm packages slip past install-script defenses by hiding in runtime code

Checkmarx researchers have detailed an ongoing npm malware campaign whose operators have learned to sidestep the platform's latest supply-chain protections. The showcase example is indexed-btree, a package impersonating the legitimate sorted-btree library. It has already racked up two million weekly downloads.

How the defenses are bypassed

In June 2026, GitHub rolled out a set of npm security measures in response to the string of attacks that had shaken the open-source ecosystem since late 2025. Among them: blocking dependency lifecycle scripts such as preinstall, install, and postinstall unless they are explicitly approved, and preventing npm from automatically pulling dependencies from Git repositories or remote URLs without permission.

The authors of indexed-btree got around all of this by dropping install scripts entirely. The malicious loader is tucked inside the BTree.prototype.set() method — the very function an application calls constantly during normal operation. Installation looks clean and trips none of npm's approval mechanisms. Checkmarx calls it a well-built way to slip past standard taint-analysis tools and most static scanners.

What the malware does

Calling the method with a specific key value fires off an obfuscated first stage. It gathers system details — architecture, hostname, CPU, memory, uptime — and exfiltrates them through hardcoded Slack and Telegram channels. It then polls an Ethereum smart contract on the Sepolia test network for command-and-control data: an X25519 key exchange derives an AES key that decrypts a second-stage payload stored in the contract. When the operators decide to end the attack, the malware can delete its files and strip the malicious trigger from the package code to erase its tracks.

The attackers went to considerable lengths to look legitimate, building a convincing GitHub repository, populating its commit history, and curating the developer account. Checkmarx notes their wallet holds 109 ETH, though the report stops short of claiming those funds came from cryptocurrency theft.

Not a lone package

Checkmarx also found and removed nine related npm packages, each with hundreds of thousands of downloads and btree-core nearing two million. They include ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-time-index, btree-lru-cache, neighbor-key-map, and sliding-score-window.

The researchers advise developers not to rely on install-time scanning alone and to add runtime behavioral analysis. Anyone who installed any of the listed packages should rotate all secrets and restore their development environment from a safe backup.

Source: Bleeping Computer