Malicious npm Package Hides Malware in Runtime Code

Key Takeaways

• A malicious npm package, indexed-btree, mimicked a legitimate library, accumulating nearly two million weekly downloads.
• The malware employs a stealthy runtime execution method, activating only when the package is utilized in an application, circumventing typical installation-time security checks.
• It performs host profiling, data exfiltration, and leverages an Ethereum Sepolia smart contract for resilient command-and-control operations.
• Security researchers at Checkmarx uncovered this campaign, highlighting critical gaps in software supply chain defenses that rely solely on installation script analysis.
• Organizations must review their dependencies, rotate exposed credentials, and implement enhanced runtime monitoring for suspicious package behavior.

A sophisticated malicious npm package, designed to appear as a standard data-indexing utility, has exposed a significant vulnerability in current software supply-chain security practices. The package, named indexed-btree, successfully impersonated the well-known sorted-btree library, achieving almost two million weekly downloads before its discovery.

What makes this campaign particularly insidious is its method of operation: the malware does not execute during the installation phase. Instead, it lies dormant within the application’s runtime code, activating only when the imported library is called upon. This tactic transforms a seemingly benign dependency into a vector for system reconnaissance, data theft, and the delivery of subsequent payloads, as identified by researchers at Checkmarx.

Checkmarx said in a report that this operation underscores why security checks narrowly focused on install scripts are insufficient to detect threats that execute later in the software lifecycle. The extensive reach of this package poses considerable risk to organizations whose development pipelines, testing environments, or production systems may have integrated this malicious dependency.

Adding to its deceptive nature, the attackers meticulously crafted a credible GitHub repository and account history for indexed-btree, further enhancing its legitimacy and enabling it to blend seamlessly into routine development workflows.

Malicious npm Package With 2 Million Downloads

The indexed-btree package conspicuously lacks any preinstall or postinstall commands in its configuration. This absence is a key element of its evasion strategy, as it prevents the malicious routine from being triggered during installation and can make the package appear harmless during superficial security reviews.

The malware’s loader is cunningly embedded within BTree.prototype.set, a fundamental method likely to be invoked when an application handles data storage. Once specific conditions are met, this code initiates an obfuscated first-stage component. This design allows the threat to execute during normal program activity, bypassing the more heavily scrutinized installation stage.

This approach fundamentally shifts the focus of defensive strategies from merely scrutinizing installer scripts to understanding a package’s behavior post-import and during active use. Previous incidents involving the abuse of trusted developer channels for delivering malicious packages demonstrate a continuous evolution in attacker tactics.

The initial stage of the malware is dedicated to gathering system intelligence, including the operating system’s architecture, hostname, processor details, memory information, and system uptime. This collected data is then transmitted to attacker-controlled endpoints. Unconventionally, instead of a traditional command-and-control (C2) server, the malware consults a smart contract on the Ethereum Sepolia test network.

This blockchain-based C2 infrastructure offers enhanced resilience against disruption. Should an attacker’s primary C2 address be blocked, the smart contract can dynamically provide a new address for the malware to connect to. The research further details how the code then utilizes a cryptographic key exchange to derive a decryption key, combining encrypted data from the smart contract to assemble and deploy a second-stage payload.

Notably, the package also incorporates functions designed to remove its malicious files and erase the trigger from the prototype method. This cleanup mechanism could effectively obscure forensic evidence after the library’s initial use within an application.

Supply-Chain Defenses Need Runtime Checks

This incident vividly demonstrates a critical vulnerability in security paradigms that equate the absence of lifecycle scripts with a package’s benign nature. Such an approach fails to detect malicious behavior directly integrated into a package’s core JavaScript functions.

Organizations must proactively identify whether any affected package names or versions are present across their entire development and deployment ecosystem, including source trees, lockfiles, build images, developer workstations, and continuous integration (CI) systems. Remediation efforts should involve the immediate removal of these packages, the rotation of any potentially exposed secrets, and a thorough inspection of logs for the Indicators of Compromise (IoCs) provided below. Dependency review processes should be expanded to include scrutiny of package ownership, release history, repository consistency, and the integrity of code distributed via the registry.

Recent reports of npm package compromises further underscore how trusted dependencies can become direct conduits for attacks on developer and CI environments. To achieve more robust security, organizations should execute suspicious packages within isolated sandboxes. Monitoring child processes, filesystem modifications, network communications, and behavior upon invocation of common methods can expose malicious runtime paths that static analysis might miss.

Developers are advised to pin reviewed dependency versions, maintain accurate Software Bills of Materials (SBOMs), and enforce strict approval processes for new or unexpectedly altered packages. The recurring pattern of backdoored npm packages and configuration abuse emphasizes the dual necessity of monitoring both installation and execution phases.

For incident responders, the immediate priority is to ascertain whether the malicious library was merely downloaded or actively used in a running process. Runtime evidence, process records, and network telemetry will provide the most definitive answers while this campaign remains a live threat.

Indicators of Compromise (IoCs):

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.