Malicious indexed-btree package moves npm malware from install scripts to first use
Attackers hid the malware trigger in the indexed-btree npm package inside a library method, sidestepping the install-script block npm 12 shipped in July. Install-time checks, including a look at package.json for hooks, pass a package that runs its payload on first use.
The Watch · Security desk
What happened
- The loader sits in btree.prototype.set and runs with the same permissions and network access as the host application, according to Suzu Labs' Jacob Krell.
- Once running, it fingerprints the host, sends stolen data out over Slack and Telegram, and takes commands through an Ethereum smart contract.
- indexed-btree imitates the legitimate sorted-btree library and anchors what researchers describe as an ongoing npm supply chain campaign.
- Its authors built a plausible GitHub repository with commit history and a developer profile with a photo, and that repository contains none of the malicious code.
Why it matters
- Who's exposed exposure A pipeline that installs with scripts disabled can still carry the package into a production service, where the payload can reach credentials, internal systems and customer data.
- What it limits constraint Clearing a new dependency now means reading or executing its library code, a slower step than checking package.json for install hooks.
- Who has to decide decision SCA blocklists cover indexed-btree only after it is flagged, so teams have to decide whether to pay for dynamic testing of running applications to catch the next lookalike.
Next story · Security · 3d ago
npm Trusted Publishing accepted a freed GitHub repo name as proof of who may publishConfirmed3 publishers
Darren Meyer, a research advocate at Checkmarx, said npm's change was meant to cut off exactly this class of malware [4]. "Attackers just moved to a new vector," he said [6]. Bruno Dias described the package and its trigger on Checkmarx's application security testing blog [3]. The victim's side of infection takes one step. A project adds indexed-btree and calls it [3].
Waseem Ahmed, head of engineering at Secure.com, said some researchers warned when npm shipped the change that the code still has to run at some point [7]. "If you close the door at install time, a patient attacker moves one step downstream and runs it at import time instead," he said [8]. He also said the absence of an install script had become a trust signal for reviewers [15]. "So the single heuristic that npm's change encouraged people to rely on is exactly the heuristic this defeats," Ahmed said [16].
Jacob Krell of Suzu Labs said a clean install tells a user only that the package manager saw nothing suspicious [10]. Sonu Kapoor, a senior Angular consultant at Solid Software Solutions, said a dependency can wait until the application uses it [17]. "That delay matters because the malicious activity can blend into normal application execution," Kapoor said [18]. "That makes relying solely on installation-time security checks insufficient," said Jason Soroko, a senior fellow at Sectigo [11].
Aviram Jenik, CEO of KhaiCode, called the package a "sleeper cell" [12]. "This makes it borderline impossible to detect by any static analysis tools, which will not see this path activated. The only way to detect this is by actively running the application with dynamic analysis," he said [13]. The code an analyst has to find ships in the package npm serves, inside the library's own prototype method [3].
Scope is thin. The ReversingLabs account names one package and calls the activity an ongoing campaign [2]. It does not give a download count, a victim count, a start date, an attributed actor or a second package [21]. On the published record, the campaign consists of one package [22].
The npm 12 default still does its job. Boris Cipot, a security engineer at Black Duck Software, said blocking preinstall and postinstall scripts removes an important attack route but does not make the package itself trustworthy [19].
What to watch
- A published list of further npm packages that hide their trigger in library methods, tying indexed-btree to a sustained operation by one actor.
- Release of the Ethereum contract address or Slack and Telegram indicators that would let defenders hunt for related packages.
- Download or victim counts for indexed-btree from Checkmarx or npm.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence66
- Adoption22
- Hype gap+14
- Incentives78
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
npm adopted a measure in July: version 12 of the package manager stopped running dependency install scripts by default, in an attempt to shut down a vector for software supply chain attacks.
- [2]
Researchers detected an ongoing npm supply chain campaign built on the malicious indexed-btree package, which mimics the legitimate sorted-btree library.
- [3]
Instead of a preinstall or postinstall script, the malware trigger is buried inside the package's own prototype method and fires the moment the library is used, Bruno Dias explained in Checkmarx's application security testing blog.
- [4]
Darren Meyer, a research advocate at Checkmarx, said the npm dependency install script change was meant to cut off exactly this class of malware.
- [5]
Once running, the malware fingerprints hosts, exfiltrates data via Slack and Telegram, and uses an Ethereum smart contract as a resilient command-and-control channel.
- [6]
"Attackers just moved to a new vector."
- [7]
Waseem Ahmed, head of engineering at Secure.com, noted that some researchers had warned when npm shipped the lifecycle script change that the code still has to run at some point.
- [8]
"If you close the door at install time, a patient attacker moves one step downstream and runs it at import time instead."
- [9]
The loader was hidden inside btree.prototype.set, so it ran in the application's normal execution context, with the same permissions and network access as the application itself.
- [10]
A clean install tells a user only that the package manager saw nothing suspicious, said Jacob Krell, senior director for secure AI solutions and cybersecurity at Suzu Labs.
- [11]
"That makes relying solely on installation-time security checks insufficient."
- [12]
Aviram Jenik, CEO of KhaiCode, said the shift to activation upon use turns the malware into a "sleeper cell" waiting for activation.
- [13]
"This makes it borderline impossible to detect by any static analysis tools, which will not see this path activated. The only way to detect this is by actively running the application with dynamic analysis."
- [14]
The attackers added a fake but plausible-looking GitHub repository and commit history and a developer profile complete with photo; the public repository contains none of the malicious code, so scanning it turns up nothing.
- [15]
Ahmed said the absence of an install script had become a trust signal: reviewers would glance at package.json, see no hooks, and relax. The btree package has a completely clean package.json, with the malware in the library's own prototype method.
- [16]
"So the single heuristic that npm's change encouraged people to rely on is exactly the heuristic this defeats."
- [17]
Sonu Kapoor, a senior Angular consultant at Solid Software Solutions, said a dependency does not need to misbehave during installation; it can wait until the application uses it, by which time it may be running in a production service with access to credentials, internal systems and customer information.
- [18]
"That delay matters because the malicious activity can blend into normal application execution."
- [19]
Boris Cipot, a security engineer at Black Duck Software, said blocking lifecycle scripts such as preinstall and postinstall removes an important attack route but does not make the package itself trustworthy.
- [20]
Software composition analysis can help when combined with malicious-package intelligence and policy enforcement, by identifying and blocking known malicious dependencies.
- [21]
The ReversingLabs account names only the indexed-btree package and reports no download count, victim count, campaign start date or attributed actor.
- [22]
On the published record, the campaign consists of one documented package, indexed-btree.
Sources
2 independent publishers whose own reporting we read for this story.
- Malicious npm Package indexed-btree Evades Install Scripts | Raven
raven.io
1 article · September 23, 2026
- reversinglabs.comDependency installation security measure already defeated on npm
1 article · October 6, 2026
Topics and entities
Topics
- Open-Source Dependency Risk
- Software Supply Chain Security
- Runtime Application Security
- npm Ecosystem Security