Malicious B-tree NPM Package Accumulates Millions of Downloads

A malicious NPM package named indexed-btree, impersonating the legitimate sorted-btree package, was discovered to contain hidden malware in its JavaScript prototype method. This supply chain attack accumulated over 2 million weekly downloads by creating a credible GitHub repository and avoiding typical detection methods. The malware collects system information, communicates with a hardcoded Slack channel and Telegram chat, and uses a blockchain smart contract for command-and-control. Multiple related malicious packages have also been identified and removed after millions of downloads. The campaign is ongoing and represents a sophisticated threat to organizations using the NPM ecosystem.

• securityweek.com/malicious-b-tree-npm-package-accumulates-millions-of-downloads/ (opens in a new tab)

• ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data ExfiltrationHighVulnerability2026-11-05
• Bring a tent, I've got the coffee: Lessons from it-saMalware2026-11-05
• Want to Rent an Internet Address at the White House?News2026-11-05
• Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into ProxiesBotnet2026-11-03
• Google Brotli · 2nd November · Threat Intelligence ReportExploitedBreach2026-11-02