Indexed-btree linked npm malware campaign
Campaign
Summary
Hide ▲
Show ▼
The indexed-btree npm malware campaign expanded to nine additional packages linked to the same operation, widening exposure across the npm ecosystem. The packages impersonated sorted-btree and used runtime execution to bypass npm v12 install-script defenses, putting developers at risk of hidden code execution. The malware could collect host details, exfiltrate them through Slack and Telegram, and use a Sepolia smart contract for command and control.
Related Happenings
Indexed-btree npm runtime malware activity
Malware Activity
H score24
First: 20.09.2026 17:11
Last: 20.09.2026 17:11
Sources 1
How related:
An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by hiding malicious code in a package's normal runtime behavior rather than in installation scripts.
About this happening:
The indexed-btree npm package is an ongoing malware activity that hides a loader in normal runtime code to evade supply-chain defenses and reach developer environments at...
Indexed-btree npm runtime malware activity
Malware ActivityHow related: An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by hiding malicious code in a package's normal runtime behavior rather than in installation scripts.
About this happening: The indexed-btree npm package is an ongoing malware activity that hides a loader in normal runtime code to evade supply-chain defenses and reach developer environments at...
WeaselBiscuit stealer delivered via 13 npm packages
Malware Activity
H score30
First: 18.09.2026 13:40
Last: 18.09.2026 13:40
Sources 1
About this happening:
The WeaselBiscuit stealer was found in 13 npm packages, expanding supply-chain risk to developer environments and extension data theft. The malware is triggered by an npm...
WeaselBiscuit stealer delivered via 13 npm packages
Malware ActivityAbout this happening: The WeaselBiscuit stealer was found in 13 npm packages, expanding supply-chain risk to developer environments and extension data theft. The malware is triggered by an npm...
North Korean npm developer-targeting blockchain-C2 campaign
Campaign
H score41
First: 29.07.2026 07:20
Last: 29.07.2026 07:20
Sources 1
About this happening:
An ongoing North Korean npm supply-chain campaign is delivering DEV#POPPER-linked payloads through compromised @joyfill packages, exposing developers to remote acces...
North Korean npm developer-targeting blockchain-C2 campaign
CampaignAbout this happening: An ongoing North Korean npm supply-chain campaign is delivering DEV#POPPER-linked payloads through compromised @joyfill packages, exposing developers to remote acces...
ViteVenom malicious npm packages delivering blockchain-backed RAT
Malware Activity
H score3
First: 17.07.2026 21:54
Last: 17.07.2026 21:54
Sources 1
About this happening:
A cluster of seven malicious npm packages has targeted the Vite frontend ecosystem, delivering a blockchain-backed RAT loader that can harvest credentials and exfiltra...
ViteVenom malicious npm packages delivering blockchain-backed RAT
Malware ActivityAbout this happening: A cluster of seven malicious npm packages has targeted the Vite frontend ecosystem, delivering a blockchain-backed RAT loader that can harvest credentials and exfiltra...
SuccessKey ViteVenom ChainVeil supply-chain campaign targeting Vite developers
Campaign
H score8
First: 17.07.2026 21:54
Last: 17.07.2026 21:54
Sources 1
About this happening:
The SuccessKey-linked ViteVenom campaign is targeting Vite developers with seven malicious npm packages and a blockchain-based C2 path that delivers a RAT....
SuccessKey ViteVenom ChainVeil supply-chain campaign targeting Vite developers
CampaignAbout this happening: The SuccessKey-linked ViteVenom campaign is targeting Vite developers with seven malicious npm packages and a blockchain-based C2 path that delivers a RAT....
Timeline
-
20.09.2026 17:11 2 articles · 1h ago
Checkmarx identifies malicious indexed-btree npm operation and linked packages
Initial DisclosureCheckmarx identified an ongoing npm malware operation centered on indexed-btree, which impersonates the legitimate sorted-btree library and hides its loader inside BTree.prototype.set() so the malicious code runs at application runtime instead of in installation scripts. The same operation was also linked to nine additional npm packages, broadening exposure across npm.
Show sources
- Malicious npm packages evade install-script defenses at runtime — www.bleepingcomputer.com — 20.09.2026 17:11
- Malicious npm packages evade install-script defenses at runtime — www.bleepingcomputer.com — 20.09.2026 17:11