Checkmarx: malicious npm indexed-btree (~2M weekly downloads) bypasses install-script defenses at runtime
Checkmarx Zero (report dated 17 September 2026; BleepingComputer amplify 20 September 2026) documents an ongoing npm malware campaign: package indexed-btree typosquats/mimics the legitimate sorted-btree B-tree library and does not use preinstall/install/postinstall lifecycle scripts. Instead a loader in BTree.prototype.set() fires at runtime when called with a specific key (key == 100), spawning obfuscated sharedLoad.min.js. Stage-1 fingerprints the host (arch, hostname, CPU/memory/uptime) and exfiltrates via hardcoded Slack and Telegram channels; C2 uses a Sepolia-testnet smart contract with X25519 ECDH → AES to decrypt a second-stage payload, plus self-clean capability. Checkmarx notes ~2 million weekly downloads and an attacker wallet holding ~109 ETH (does not claim those funds are from theft). Sidesteps npm v12 lifecycle-script approval controls that defenders may treat as a clean install signal. No CVE assigned in the primary. Developers: remove indexed-btree, pin/verify sorted-btree from the legitimate maintainer, audit lockfiles for unexpected btree deps, rotate any secrets on hosts that imported the package.
- Product
- npm package indexed-btree (malicious; mimics sorted-btree)
- Versions
- n/a (malware package; Checkmarx: ~2M weekly downloads at report time)
- Exploited in Australia?
- unknown
- Patch to
- Remove indexed-btree; depend only on legitimate sorted-btree; audit lockfiles; rotate secrets on hosts that imported the package; do not treat absence of install scripts as proof of safety (npm v12 lifecycle limits)
Primary: Checkmarx Zero — npm indexed-btree / sorted-btree runtime malware campaign (17 Sep 2026) · BleepingComputer — amplify (20 Sep 2026)