Malicious npm packages evade install-script defenses at runtime

Summary

Checkmarx identified an ongoing npm supply-chain malware campaign centered on the malicious "indexed-btree" package, which impersonates "sorted-btree" and evades install-script protections by executing a hidden runtime loader when BTree.prototype.set() receives a specific key. The malware collects host information, exfiltrates it through Slack and Telegram, and obtains second-stage payload information from an Ethereum Sepolia smart contract. Checkmarx removed nine related packages from npm and advises affected developers to rotate secrets and restore development environments from safe backups.

Key points

• The malicious "indexed-btree" npm package hides its loader in BTree.prototype.set() rather than preinstall, install, or postinstall scripts, avoiding npm v12 approval mechanisms.
• The runtime trigger launches sharedLoad.min.js, described by Checkmarx as an obfuscated first-stage malware component.
• The malware can collect system architecture, hostname, CPU, memory, and uptime, then exfiltrate the information through hardcoded Slack and Telegram channels.
• It polls an Ethereum smart contract on the Sepolia test network for C2 information, derives an AES key using X25519 key exchange, and decrypts a second-stage payload stored in the contract.
• The malware can delete its files and remove the malicious package trigger to erase traces when operators end the attack.
• Checkmarx found and removed nine additional npm packages linked to the operation; the source reports that indexed-btree had reached 2 million weekly downloads.
• Developers who installed indexed-btree or the identified related packages are advised to rotate all secrets and restore their development environment from a safe backup.

Tags

MITRE ATT&CK

Malware

Vendors

Products

Industries