Malicious npm Package indexed-btree Executes Loader at Runtime After npm Lifecycle Script Block

Immediate Threat Overview

A malicious npm package called indexed-btree was published on June 18, 2026 and, within weeks, amassed millions of downloads before being removed from the registry. Unlike prior supply-chain attacks that relied on preinstall or postinstall hooks, this package executed its payload entirely from application code at runtime, directly subverting the security hardening introduced in npm 12 that blocks automatic execution of lifecycle scripts. The campaign generated an estimated €230,933.57 (approximately 109 ETH) in cryptocurrency earnings for the operators, according to Checkmarx’s investigation Thehackernews.

Technical Mechanics of the Loader

The malicious code is concealed inside the BTree.prototype.set() method of the library, a function that would normally be used to insert key/value pairs into a B-tree structure. When an application calls this method, the code triggers a secondary script named sharedLoad.min.js. This script contains an obfuscated first-stage payload that performs the following actions:

1. Host fingerprinting – collects OS details, Node.js version, and environment variables.
2. Beaconing – sends the fingerprint to a hard-coded Slack channel and a Telegram bot, providing the attacker with real-time visibility of infected hosts.
3. EtherHiding retrieval – contacts a smart contract deployed on the Sepolia testnet, downloads encrypted binary blobs, and decrypts them using a key derived from the host fingerprint.
4. Second-stage assembly – merges the decrypted blobs into a full back-door payload, which is then executed in memory.
5. Self-cleanup – deletes the sharedLoad.min.js file and removes the trigger code from the package source, leaving minimal forensic evidence.

The use of EtherHiding demonstrates a growing trend of leveraging blockchain infrastructure for stealthy payload delivery, a technique also observed in the PolinRider campaign targeting PHP packages on Packagist.

Timeline and Scope

Date	Event
2026-06-18	indexed-btree first published by npm user charlessadler25
2026-06-20 – 2026-07-15	Package climbs to several million downloads across open-source projects
2026-07-10	Checkmarx identifies runtime loader and reports findings
2026-07-12	npm removes indexed-btree and nine related packages (e.g., ordered-kv-index, btree-leaderboard)
2026-09-22	Public disclosure by The Hacker News

The rapid download volume suggests that many projects incorporated the package as a drop-in replacement for the legitimate sorted-btree library, unaware of the embedded malicious logic.

Impact on the Ecosystem

The incident underscores two immediate risks:

• Widespread infection – any Node.js application that imports indexed-btree and invokes set() will automatically execute the loader, potentially compromising development, CI/CD pipelines, and production environments.
• Economic incentive – the €230k profit demonstrates that even short-lived supply-chain malware can be financially viable, encouraging further investment in similar techniques.

Beyond the direct victims, the episode raises concerns for downstream consumers of npm packages, including enterprises that rely on automated dependency management tools such as Renovate or Dependabot. Those tools may flag the package as a version bump, inadvertently propagating the malicious code if the underlying version is not vetted.

Defensive Recommendations

The shift from install-time hooks to runtime execution demands a layered defense strategy:

1. Static analysis of package code – integrate tools that scan for suspicious patterns (e.g., unexpected network calls, hard-coded webhook URLs) during CI builds.
2. Runtime behavior monitoring – employ endpoint detection and response (EDR) solutions capable of flagging anomalous outbound connections to Slack, Telegram, or blockchain nodes.
3. Policy enforcement on lifecycle scripts – continue to block preinstall/postinstall scripts, but complement this with a denylist of known malicious package names and a reputation service for newly published modules.
4. Supply-chain provenance – adopt the npm --audit flag and enable the npm audit advisory database, while also considering the use of npm ci --prefer-offline to limit exposure to newly published versions.
5. Incident response playbooks – prepare procedures for rapid removal of compromised dependencies, including automated PR generation to replace malicious packages with vetted alternatives.

The recommendations align with statements from Checkmarx and SOCRadar’s CISO, who emphasized that “security controls change attacker behavior rather than eliminate the underlying threat.”

Broader Implications for npm and Open-Source Security

npm’s decision to block automatic lifecycle script execution was a direct response to high-profile attacks such as the event-stream incident in 2018. The indexed-btree case illustrates the adaptive nature of threat actors: once a defensive surface is hardened, they migrate to less-monitored vectors. This mirrors the evolution seen in the PolinRider campaign, where attackers moved from npm to PHP package registries and leveraged Git-based intrusions to inject malicious code.

For the open-source community, the episode reinforces the need for continuous vetting of dependencies, not just at the point of installation. Projects should consider pinning exact versions and maintaining a software-bill-of-materials (SBOM) that can be audited for unexpected changes.

What to Watch Next

The indexed-btree takedown is unlikely to be the final instance of runtime-loader attacks. Security researchers should monitor for:

• New npm packages that mimic popular utilities but contain hidden methods invoking network calls.
• Increases in blockchain-based payload delivery, especially on testnets that are less scrutinized.
• Reports of similar techniques in other language ecosystems (e.g., PyPI, RubyGems) where install-time hooks have also been restricted.

Stakeholders are encouraged to follow the npm security advisory feed and to subscribe to threat-intel feeds that track blockchain-related C2 infrastructure.

Related Coverage

For additional context on supply-chain attacks that bypass install-time defenses, see the analysis of the recent TanStack npm supply-chain breach, which also leveraged runtime code injection.

---

This article adheres to Fastest News AI’s editorial standards for factual, actionable threat intelligence.

Related coverage

• TanStack npm supply chain attack fuels CrowdSec breach of 170 private repos
• npm supply chain attack RedC2 Deploys AI-Powered Linux Backdoor
• Cisco 0-Day Vulnerability Exposes Users to Remote Exploitation

Explore more on this topic

• More software-supply-chain coverage