Cybersecurity
Malicious npm packages bypass install-script checks at runtime
Checkmarx said an npm campaign centred on indexed-btree hid its loader in normal runtime code, let the package appear clean at install, and used extra packages to spread the operation.
- Checkmarx said indexed-btree impersonated the legitimate sorted-btree library and had about 2 million weekly downloads.
- GitHub announced npm security measures in June 2026 to restrict lifecycle scripts and some dependency fetching.
- The package avoided those checks by placing its loader in a method that ran only when the application called it with a specific key.
- Checkmarx said the code collected system details, sent them through hardcoded Slack and Telegram channels, and queried a smart contract on the Sepolia test network for command-and-control data.
- Checkmarx said it found nine further linked npm packages and advised developers to rotate secrets and restore affected environments from backup.
Checkmarx said the indexed-btree package was part of an ongoing npm malware campaign and was built to resemble the legitimate sorted-btree library. The firm said the package had about 2 million weekly downloads.
The report said GitHub introduced npm security measures in June 2026 to block lifecycle scripts and some dependency retrieval without approval. Indexed-btree avoided those checks by keeping its loader inside a normal runtime method rather than in an install script.
According to Checkmarx, the loader activated a first-stage file called sharedLoad.min.js, which then gathered machine details and sent them through hardcoded Slack and Telegram channels. The malware also queried an Ethereum smart contract on the Sepolia test network for command-and-control information and used X25519 to derive an AES key for a second-stage payload.
Checkmarx said the operators could delete files and remove the trigger from the package code when they wanted to end the attack. It also said it found nine other linked npm packages, removed them from npm, and urged developers to use runtime behavioural analysis as well as install-time scanning.
Named in this story
Companies
- Checkmarx
- the researchers that spotted and analysed the package
- GitHub
- announced npm security measures in June 2026
- Slack
- a channel used to exfiltrate system details
- Telegram
- a channel used to exfiltrate system details
Products and systems
- indexed-btree
- the malicious npm package at the centre of the campaign
- sorted-btree
- the legitimate library that indexed-btree tried to imitate
- npm
- the package ecosystem whose install checks were bypassed
- npm v12
- the version whose approval mechanisms did not trigger
- sharedLoad.min.js
- the obfuscated first-stage loader triggered by the package
- Ethereum smart contract on the Sepolia test network
- the contract the malware polled for command-and-control data
How the source tells it
Mostly straight incident reporting with a cautious advisory register and some alarm in the framing of bypassed defences and trace removal.
- urgency defensive guidance and cleanup steps were given at the end
- alarm loaded wording around bypassing the newest security checks and erasing traces