Malicious B-tree NPM Package Accumulates Millions of Downloads
A malicious NPM package named indexed-btree, impersonating the legitimate sorted-btree package, was discovered to contain hidden malware in its JavaScript prototype method. This supply chain attack accumulated over 2 million weekly downloads by creating a credible GitHub repository and avoiding typical detection methods. The malware collects system information, communicates with a hardcoded Slack channel and Telegram chat, and uses a blockchain smart contract for command-and-control. Multiple related malicious packages have also been identified and removed after millions of downloads. The campaign is ongoing and represents a sophisticated threat to organizations using the NPM ecosystem.
AI Analysis
Technical Summary
The indexed-btree NPM package, posing as the legitimate sorted-btree utility, contains malicious code hidden in the BTree.prototype.set method. This malware collects system information and exfiltrates it via hardcoded Slack and Telegram channels. It connects to a blockchain smart contract on Sepolia for command-and-control, retrieving and decrypting a second-stage payload before cleaning traces. The threat actor established a legitimate-looking GitHub repository with multiple commits to evade detection. This supply chain attack bypassed recent NPM protections by embedding malicious triggers in prototype code rather than install scripts. Related malicious packages linked to this campaign have collectively amassed over 5 million downloads before removal. The attacker reportedly profited approximately 109 ETH (~$300,000) from this campaign.
Potential Impact
The malicious package enables attackers to execute arbitrary JavaScript code on systems that install it, potentially leading to system information disclosure and further compromise via a resilient blockchain-based command-and-control infrastructure. The campaign's scale, with millions of downloads, increases the risk of widespread impact in organizations relying on affected NPM packages. The use of stealth techniques such as hiding code in prototype methods and maintaining a credible GitHub repository complicates detection and mitigation.
Mitigation Recommendations
No official patch or remediation from the vendor is indicated in the provided information. Users should immediately remove the indexed-btree package and other identified malicious packages (ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, sliding-score-window) from their projects. Audit dependencies for these packages and replace them with legitimate alternatives. Monitor for updates from NPM and Checkmarx regarding detection and removal of similar malicious packages. Employ supply chain security best practices such as verifying package provenance and using tools that detect malicious code in dependencies.
Malicious B-tree NPM Package Accumulates Millions of Downloads
Description
A malicious NPM package named indexed-btree, impersonating the legitimate sorted-btree package, was discovered to contain hidden malware in its JavaScript prototype method. This supply chain attack accumulated over 2 million weekly downloads by creating a credible GitHub repository and avoiding typical detection methods. The malware collects system information, communicates with a hardcoded Slack channel and Telegram chat, and uses a blockchain smart contract for command-and-control. Multiple related malicious packages have also been identified and removed after millions of downloads. The campaign is ongoing and represents a sophisticated threat to organizations using the NPM ecosystem.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The indexed-btree NPM package, posing as the legitimate sorted-btree utility, contains malicious code hidden in the BTree.prototype.set method. This malware collects system information and exfiltrates it via hardcoded Slack and Telegram channels. It connects to a blockchain smart contract on Sepolia for command-and-control, retrieving and decrypting a second-stage payload before cleaning traces. The threat actor established a legitimate-looking GitHub repository with multiple commits to evade detection. This supply chain attack bypassed recent NPM protections by embedding malicious triggers in prototype code rather than install scripts. Related malicious packages linked to this campaign have collectively amassed over 5 million downloads before removal. The attacker reportedly profited approximately 109 ETH (~$300,000) from this campaign.
Potential Impact
The malicious package enables attackers to execute arbitrary JavaScript code on systems that install it, potentially leading to system information disclosure and further compromise via a resilient blockchain-based command-and-control infrastructure. The campaign's scale, with millions of downloads, increases the risk of widespread impact in organizations relying on affected NPM packages. The use of stealth techniques such as hiding code in prototype methods and maintaining a credible GitHub repository complicates detection and mitigation.
Defensive Guidance
No official patch or remediation from the vendor is indicated in the provided information. Users should immediately remove the indexed-btree package and other identified malicious packages (ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, sliding-score-window) from their projects. Audit dependencies for these packages and replace them with legitimate alternatives. Monitor for updates from NPM and Checkmarx regarding detection and removal of similar malicious packages. Employ supply chain security best practices such as verifying package provenance and using tools that detect malicious code in dependencies.
Technical Details
- Classification
- {"confidence":0.3,"severitySource":"default","classifier":"rss-v2"}
- Article Source
- {"url":"https://www.securityweek.com/malicious-b-tree-npm-package-accumulates-millions-of-downloads/","fetched":true,"fetchedAt":"2026-09-22T11:47:47.066Z","wordCount":993}
Threat ID: 6ab26ae3f7a7c541061c8308
Added to database: 09/22/2026, 11:47:47 UTC
Last enriched: 09/22/2026, 11:47:53 UTC
Last updated: 09/23/2026, 12:10:46 UTC
Views: 28
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.