Cybersecurity
Malicious npm package indexed-btree hides loader in runtime code
Checkmarx said the removed npm package indexed-btree moved its loader into normal runtime code, while the wider article also described a related Packagist campaign and defensive advice.
- Checkmarx said indexed-btree mimicked sorted-btree and executed its malicious logic from application code instead of install hooks.
- The package and its GitHub repository were no longer available on npm, and registry data showed an initial upload on 18 June 2026 by charlessadler25.
- Checkmarx said the package reached millions of downloads and may have earned about €230,933.57, or 109 ETH.
- Socket said it deleted malicious code from visanduma/nova-two-factor as part of the PolinRider campaign, which it linked to a compromised Visanduma GitHub organisation.
Checkmarx said indexed-btree was a malicious npm package that copied the legitimate sorted-btree utility and moved its code execution into ordinary application paths rather than install-time hooks. The report linked that approach to npm version 12, which restricted automatic lifecycle-script execution.
npm and the package's GitHub repository were no longer available. Registry data showed an initial upload on 18 June 2026 from the account charlessadler25, and Checkmarx said the package reached millions of downloads.
Checkmarx said the operation may have earned about €230,933.57, or 109 ETH. It said the loader sat in BTree.prototype.set(), started sharedLoad.min.js, fingerprinted the host, sent details to Slack and Telegram, and fetched encrypted follow-on data from a contract on Sepolia testnet.
Checkmarx also said several other npm packages linked to the same operation had been removed. It recommended runtime behaviour analysis alongside install-time checks.
Socket separately said it deleted malicious code from the dev-main version of visanduma/nova-two-factor, a Packagist package with more than 700,000 downloads, in the PolinRider campaign. Socket said Visanduma's GitHub organisation had been compromised since mid-June 2026 through the LaHiRu developer account, and that code had been inserted into index.php and run via PHP shell_exec().
Named in this story
People
- charlessadler25
- npm user who first uploaded the package
- Ensar Seker
- SOCRadar CISO who commented on attacker adaptation
- LaHiRu
- developer account used to introduce malicious changes
Companies
- Checkmarx
- security company that reported the findings
- SOCRadar
- company whose CISO commented on the campaign
- Socket
- security company that reported the Packagist activity
Organisations
- Visanduma GitHub organization
- repository organisation Socket said had been compromised
Products and systems
- indexed-btree
- malicious npm package that hid its loader in runtime code
- sorted-btree
- legitimate package that indexed-btree mimicked
- npm
- registry where the package was uploaded and later removed
- sharedLoad.min.js
- JavaScript payload launched by the loader
- Slack
- destination for beaconed host details
- Telegram
- destination for beaconed host details
- visanduma/nova-two-factor
- Packagist package whose malicious code was removed
- Packagist
- package repository where the code appeared
- PolinRider
- campaign name Socket linked to the activity
How the source tells it
The article was a vendor-led technical report, but it leaned into threat-focused framing and immediate defensive urgency.
- alarm it heightened concern with worsening language and profit estimates
- urgency it ended by pressing for layered controls and runtime analysis