cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

Malicious npm Packages Hide Payloads in Runtime Behavior to Evade Install Protections

· Original article ↗

Summary

Checkmarx found indexed-btree and nine related npm packages impersonating legitimate libraries. The malware triggers at runtime, collects system details and uses an Ethereum smart contract for C2; developers are advised to rotate secrets and restore affected systems.

Key points

  • indexed-btree impersonates the legitimate sorted-btree library and reportedly reached 2 million weekly downloads.
  • The malware avoids install scripts and hides its loader in BTree.prototype.set(), triggering when the application calls the method with a specific key.
  • The payload can collect system details, including hostname, architecture, CPU, memory and uptime, and exfiltrate them through Slack and Telegram.
  • It polls an Ethereum smart contract on the Sepolia test network for C2 information and decrypts a second-stage payload using an AES key derived through X25519 key exchange.
  • The malware can delete its files and remove its trigger from package code when operators end the attack, according to the report.
  • Checkmarx identified nine related npm packages, which it says have been removed from npm.
  • Developers who installed the packages are advised to rotate secrets and restore their development environments from a safe backup; runtime behavioral analysis is recommended.

Article Details

Attack Vectors
  • Malicious npm packages impersonated the legitimate sorted-btree library and concealed a loader in BTree.prototype.set(), triggering when called with a specific key at runtime rather than through an installation script.
  • The loader triggered an obfuscated first-stage payload in sharedLoad.min.js. The malware collected system details and exfiltrated them through Slack and Telegram channels.
  • The malware polled an Ethereum smart contract on the Sepolia test network for command-and-control information and decrypted a second-stage payload stored in the contract using a key derived through X25519 key exchange.
  • The operators could delete files and remove the malicious trigger from package code to erase traces.
Defensive Notes
  • Do not rely on install-time scanning alone; use runtime behavioral analysis.
  • Developers who installed indexed-btree or any of the nine related packages should rotate all secrets and restore their development environment from a safe backup.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe article describes the first-stage malware in sharedLoad.min.js as obfuscated.T1059.007 · JavaScriptThe package concealed a loader in BTree.prototype.set(), which executed JavaScript at runtime when called with a specific key.T1070.004 · File DeletionThe malware could delete its files when the operators chose to end the attack.T1082 · System Information DiscoveryThe malware collected system details including architecture, hostname, CPU, memory, and uptime.T1102 · Web ServiceThe malware polled an Ethereum smart contract on the Sepolia test network for command-and-control information.T1195.001 · Compromise Software Dependencies and Development ToolsThe malicious indexed-btree package and nine related npm packages were distributed through the software supply chain.T1567 · Exfiltration Over Web ServiceThe malware exfiltrated collected system information through Slack and Telegram channels.

Products

EthereumCheckmarx found the package and nine related npm packages, which exposed victims to data theft, C2 activity through Slack, Telegram, and an Ethereum smart contract, and possible trace removal by the attackers.GitHubThe indexed-btree npm campaign hides malicious code in normal runtime behavior to bypass new GitHub and npm supply chain defenses, while impersonating the legitimate sorted-btree library.npmThe indexed-btree npm campaign hides malicious code in normal runtime behavior to bypass new GitHub and npm supply chain defenses, while impersonating the legitimate sorted-btree library.SlackCheckmarx found the package and nine related npm packages, which exposed victims to data theft, C2 activity through Slack, Telegram, and an Ethereum smart contract, and possible trace removal by the attackers.TelegramCheckmarx found the package and nine related npm packages, which exposed victims to data theft, C2 activity through Slack, Telegram, and an Ethereum smart contract, and possible trace removal by the attackers.

Related Articles