Overview
A malicious npm package called indexed-btree has been caught running a supply chain attack that skips the part of the install process most defenses now watch closely. Instead of dropping a payload through a postinstall script, the package waits until a victim's own application calls one of its normal functions, then triggers there. Checkmarx researchers, who discovered the campaign, say it and nine related packages were downloaded roughly 5.9 million times combined before being flagged.
How the Evasion Works
indexed-btree impersonates sorted-btree, a legitimate and widely used ordered-map library, copying its API surface closely enough to pass casual review. The primary package alone accounts for about 2 million weekly downloads; the nine related packages Checkmarx traced to the same operation range from roughly 366,000 to 1.95 million downloads each.
The malicious logic sits dormant through installation, when npm's and GitHub's newer scanning defenses are most likely to catch it, and only activates once the host application calls BTree.prototype.set() with a specific key value during normal runtime use. Because nothing unusual happens at install time, the package looks clean to tooling built around monitoring install scripts — a class of defense that npm and GitHub have both leaned on more heavily since the wave of worm-style supply chain attacks in late 2025.
What the Payload Does
Once triggered, the malware collects system fingerprinting data — architecture, hostname, CPU, memory, and uptime — and exfiltrates it through hardcoded Slack and Telegram channels. For command-and-control instructions, it also polls an Ethereum smart contract deployed on the Sepolia test network, decrypting responses with X25519 key exchange. Checkmarx notes the attacker-controlled wallet tied to the operation holds 109 ETH, though the report stops short of confirming those funds came from this specific campaign.
The operators also invested in making the packages look legitimate: fabricated commit histories and GitHub repositories dressed up to resemble a real, actively maintained open source project.
Why It Matters
The technique undercuts a whole category of supply chain defense that assumes malicious code shows up during npm install. Runtime-triggered payloads hide inside behavior developers exercise routinely — calling a data-structure method is about as unremarkable as JavaScript gets — which makes static, install-time scanning insufficient on its own. Checkmarx recommends shifting toward runtime behavioral monitoring in addition to install-script auditing, alongside the now-standard hygiene of frozen lockfiles, private registry routing, and treating any unfamiliar dependency's actual data flows as unverified until checked.