Npm Btree Malware Campaign Evades Security Measures

• •The 'indexed-btree' package bypasses npm's security by hiding malware in runtime code.
• •Attackers have earned approximately €230,933.57 from this campaign using Ethereum.
• •Checkmarx identified nine additional malicious npm packages linked to this operation.

A malicious npm package named 'indexed-btree' is part of an ongoing supply chain attack, affecting millions of downloads. This package mimics the legitimate 'sorted-btree' library and has achieved nearly 2 million weekly downloads. Instead of using traditional install scripts, the malware is activated through the package's BTree.prototype.set method during runtime. The attackers have reportedly earned 109 ETH, approximately €230,933.57, from this campaign. The malware collects system information and exfiltrates it via hardcoded Slack and Telegram channels. Security measures introduced by GitHub in June 2026, aimed at blocking lifecycle scripts, have been bypassed by this method. Checkmarx has identified nine additional npm packages linked to the same operation, which have also garnered significant downloads. The campaign is ongoing, and further updates are expected as more details emerge.