Malicious code in btd-smart (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3ad22b27351879a89349a1232ee5abb46bc589399ea710b9769526a8080b3199) The package presents itself as a clone of juliangruber/balanced-match (stolen author identity 'Julian Gruber <[email protected]>', verbatim README, identical API renamed btdSmart, placeholder homepage 'github.com/your-org/btd-smart'). Appended to the legitimate code in index.js is an obfuscated block that runs unconditionally when the module is required. A custom string-shuffle decoder reconstructs the identifier 'constructor' (and other strings) without any literal occurrences in the file, retrieves the Function constructor from a string prototype, builds a function from a decoded source body, and invokes it. Before invocation, the code stashes `require` and `module` onto `global` under decoder-produced keys so the Function-built code — which otherwise has no closure scope — gains filesystem, network, and process capabilities. The payload body is opaque (deterministic numerical shuffle with 0x7F-based escape tricks across two nested decoders), executes on every `require('btd-smart')`, and the legitimate balanced-match code above it has no obfuscation, confirming the appended block is purposefully hidden. Combined signals — typosquat with stolen identity, custom obfuscator, dynamic Function eval of a decoded blob at module load, deliberate global-smuggling of require/module — match the documented active-attack shape; no legitimate brace-matching utility needs any of these mechanisms. ## Source: ghsa-malware (8edce8a8e04e183f3bd29cb37d2f3916debf1ebd05c0cbe50fb5f1920f2fa932) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The 'btd-smart' package impersonates the 'balanced-match' package by copying its README and API but appends an obfuscated block of code that executes on module load. This code reconstructs the Function constructor via a custom string-shuffle decoder, then dynamically builds and runs a hidden payload. It also exposes Node.js internals like 'require' and 'module' to the payload by storing them on the global object under obfuscated keys, granting it extensive capabilities. These behaviors are consistent with active malicious attacks and are unnecessary for any legitimate brace-matching utility.
Potential Impact
Any system with 'btd-smart' installed or running is considered fully compromised. The malicious payload can execute arbitrary code with filesystem, network, and process privileges, potentially leading to complete system takeover. All secrets and keys on the affected system should be assumed compromised and require immediate rotation. Removing the package alone may not eliminate all malicious artifacts or backdoors.
Mitigation Recommendations
No official patch or fix is available. Immediate removal of the 'btd-smart' package versions 1.0.2 and 1.0.3 is recommended. Systems with this package installed should be treated as compromised, and all sensitive credentials should be rotated from a secure environment. Conduct a thorough investigation for additional malicious software or persistence mechanisms. Monitor for any suspicious activity related to this package.
Malicious code in btd-smart (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3ad22b27351879a89349a1232ee5abb46bc589399ea710b9769526a8080b3199) The package presents itself as a clone of juliangruber/balanced-match (stolen author identity 'Julian Gruber <[email protected]>', verbatim README, identical API renamed btdSmart, placeholder homepage 'github.com/your-org/btd-smart'). Appended to the legitimate code in index.js is an obfuscated block that runs unconditionally when the module is required. A custom string-shuffle decoder reconstructs the identifier 'constructor' (and other strings) without any literal occurrences in the file, retrieves the Function constructor from a string prototype, builds a function from a decoded source body, and invokes it. Before invocation, the code stashes `require` and `module` onto `global` under decoder-produced keys so the Function-built code — which otherwise has no closure scope — gains filesystem, network, and process capabilities. The payload body is opaque (deterministic numerical shuffle with 0x7F-based escape tricks across two nested decoders), executes on every `require('btd-smart')`, and the legitimate balanced-match code above it has no obfuscation, confirming the appended block is purposefully hidden. Combined signals — typosquat with stolen identity, custom obfuscator, dynamic Function eval of a decoded blob at module load, deliberate global-smuggling of require/module — match the documented active-attack shape; no legitimate brace-matching utility needs any of these mechanisms. ## Source: ghsa-malware (8edce8a8e04e183f3bd29cb37d2f3916debf1ebd05c0cbe50fb5f1920f2fa932) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'btd-smart' package impersonates the 'balanced-match' package by copying its README and API but appends an obfuscated block of code that executes on module load. This code reconstructs the Function constructor via a custom string-shuffle decoder, then dynamically builds and runs a hidden payload. It also exposes Node.js internals like 'require' and 'module' to the payload by storing them on the global object under obfuscated keys, granting it extensive capabilities. These behaviors are consistent with active malicious attacks and are unnecessary for any legitimate brace-matching utility.
Potential Impact
Any system with 'btd-smart' installed or running is considered fully compromised. The malicious payload can execute arbitrary code with filesystem, network, and process privileges, potentially leading to complete system takeover. All secrets and keys on the affected system should be assumed compromised and require immediate rotation. Removing the package alone may not eliminate all malicious artifacts or backdoors.
Mitigation Recommendations
No official patch or fix is available. Immediate removal of the 'btd-smart' package versions 1.0.2 and 1.0.3 is recommended. Systems with this package installed should be treated as compromised, and all sensitive credentials should be rotated from a secure environment. Conduct a thorough investigation for additional malicious software or persistence mechanisms. Monitor for any suspicious activity related to this package.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-4501
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-m4m6-q4p8-3vjv"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a4c342c27e9c797195fa599
Added to database: 07/06/2026, 23:03:08 UTC
Last enriched: 07/06/2026, 23:24:17 UTC
Last updated: 07/18/2026, 17:27:21 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.