Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal

Summary

A malicious npm package named 'indexed-btree' mimicked a legitimate utility but hid its malware loader within application runtime code, bypassing recent npm security changes that restrict automatic execution of lifecycle scripts. The package, uploaded by 'charlessadler25', amassed millions of downloads before removal and potentially earned the attacker over €230,000 in cryptocurrency. This tactic shift highlights attackers adapting to new defenses by embedding malicious code directly into library functions.

Full text

Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal Ravie LakshmananSep 22, 2026Supply Chain Attack / Malware A malicious npm package named "indexed-btree" has been observed hiding its malicious behavior within application code rather than using lifecycle scripts, indicating that threat actors are likely shifting tactics in response to recent security controls. "Indexed-btree is a malicious npm package mimicking the legit sorted-btree package, an ordinary B-tree/indexing utility," Checkmarx said. "Unlike the common attacks we've seen in the supply chain space, this package does not rely on preinstall / postinstall at all. Instead, it runs entirely from application code at runtime." The package and the associated GitHub repository are no longer available for download from npm. However, statistics show the package was first uploaded to the registry on June 18, 2026, by an npm user named "charlessadler25," amassing millions of downloads in a short span of time. To make matters worse, the campaign may have generated illicit profits for the threat actor, earning them around €230,933.57 in cryptocurrency (i.e., 109 ETH). The development comes as npm version 12 introduced a security change to prevent automatic execution of lifecycle scripts such as preinstall or postinstall, which is one of the most common ways malware is executed through packages distributed through the repository. "Legitimately, these are often used for compiling necessary code, seeding data, or setting up essential configurations," Checkmarx said. "For threat actors, however, this is frequently exploited to automatically execute malicious code without user consent during the installation of a malicious package." The latest findings from the software supply chain security company show that bad actors are shifting tactics in response to the change, eschewing install hooks in favor of incorporating the malicious code directly within the library. In this case, the malware loader is concealed inside a "BTree.prototype.set()" method, which then triggers "sharedLoad.min.js," a JavaScript payload that embeds the obfuscated first stage of the malware. The malware is designed to fingerprint the host, beacon the details to a hard-coded Slack channel and Telegram bot, uses the EtherHiding technique to pull next-stage, encrypted blobs from a smart contract deployed on Sepolia testnet, and finally merge them to form the second-stage payload. The final step involves deleting the malicious artifacts and removing the trigger from the package code to cover up the tracks. Checkmarx said indexed-btree is one of the many npm packages tied to the same operation, all of which have since been removed from npm - ordered-kv-index btree-leaderboard priority-slot-queue btree-range-store btree-core btree-time-index btree-lru-cache neighbor-key-map sliding-score-window mutex-forge To counter the threat, developers are recommended not to stick only to install-time scanning and blocking lifecycle scripts alone, but also employ runtime behavior analysis. "What makes this campaign particularly important is that it shows attackers adapting almost immediately to stronger software supply chain defenses," Ensar Seker, CISO at SOCRadar, said in a statement shared with The Hacker News. "Npm has improved install time security by restricting dependency lifecycle scripts, but this campaign demonstrates that attackers can simply move malicious execution into legitimate-looking runtime functionality instead." "The broader lesson is that security controls change attacker behavior rather than eliminate the underlying threat. Blocking lifecycle scripts is an important improvement, but attackers will continue searching for alternative execution paths. Defenders, therefore, need layered controls capable of detecting malicious behavior before installation, during execution, and after deployment." PolinRider Resurfaces on Packagist The disclosure comes as Socket said it deleted malicious code in the "dev-main" version of "visanduma/nova-two-factor," a Packagist package with over 700,000 cumulative downloads, as part of an ongoing North Korea-linked malicious cyber campaign dubbed PolinRider. A defining trait of PolinRider is the threat actor's pattern of compromising developer accounts to inject malicious content into source code repositories and employ routine developer actions, such as cloning a repository or opening it in an integrated development environment (IDE), as triggers to activate the infection chain. This often entails rewriting Git history, concealing payloads within configuration or font files, setting up malicious VS Code auto-run tasks, and relying on takedown-resistant techniques like EtherHiding and its stealth-focused successor, NullReceiver, for staged-payload delivery via the blockchain. "Analysis of the Visanduma GitHub organization indicates that its repositories have been compromised since mid-June 2026," Socket security researcher Karlo Zanki said. "The malicious changes were introduced through the LaHiRu developer account." One notable shift observed in the latest iteration is the direct insertion of heavily obfuscated JavaScript into "index.php" and its execution through PHP's "shell_exec()" function. This approach, besides allowing a PHP entry point to invoke the JavaScript infection chain, suggests the threat actors are adapting their execution methods based on the compromised project instead of using a fixed delivery path. "The activity reinforces a defining characteristic of PolinRider: package-registry compromise is often a consequence of a broader Git-based intrusion rather than the campaign's primary objective," Socket said. "The operators use ordinary source-code collaboration to reach developer environments, spread into additional repositories, and maintain access over time." "Compromised source repositories give the operators opportunities to infect contributors, access private projects, and propagate through normal development workflows. Package publication becomes an additional distribution path when a compromised repository produces a new release." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Malware, Nation-State, Open Source Security, Supply Chain ⚡ Top Stories This Week Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws Google Gemini Broke Into Real Company Systems After Security Test Domain Mix-Up OpenAI Reveals Six Model Incidents Involving Hidden Failures and Unauthorized Uploads Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users Attackers Use

Indicators of Compromise

• malware — indexed-btree
• url — https://sepolia.etherscan.io/

Entities