The npm package 'sort-btree' versions 2.1.6 and 2.2.0 contain malicious code. Analysis detected suspicious keywords related to child process execution and HTTP tokens in minified files, but no confirmed evidence of network exfiltration or attacker-controlled endpoints was found. Despite this, the package is considered fully compromising any system where it is installed or running. Immediate removal of the package and rotation of all secrets and keys from a separate, uncompromised system is advised.