Indexed-btree npm runtime malware activity
Malware Activity
Summary
Hide ▲
Show ▼
indexed-btree is a malicious npm package that mimics sorted-btree and hides its loader in runtime application code through BTree.prototype.set(), letting a normal call trigger sharedLoad.min.js instead of relying on install hooks. Checkmarx said the package bypasses npm v12 lifecycle-script defenses, can collect host details and exfiltrate them to hardcoded Slack and Telegram channels, and can poll a Sepolia smart contract for staged command-and-control data. The package was first uploaded on June 18, 2026 by charlessadler25, later removed from npm, and the article says it amassed millions of downloads and was part of a broader operation that included nine additional npm packages removed by Checkmarx.
Related Happenings
PhantomSub Baileys-abusing npm package activity
Malware Activity
H score21
First: 29.09.2026 16:45
Last: 29.09.2026 16:45
Sources 1
About this happening:
The discovery of 101 malicious npm packages abusing Baileys has exposed developers to unwanted WhatsApp group and channel subscriptions across a package set downloaded...
PhantomSub Baileys-abusing npm package activity
Malware ActivityAbout this happening: The discovery of 101 malicious npm packages abusing Baileys has exposed developers to unwanted WhatsApp group and channel subscriptions across a package set downloaded...
Indexed-btree linked npm malware campaign
Campaign
H score26
First: 20.09.2026 17:11
Last: 20.09.2026 17:11
Sources 1
How related:
Checkmarx also discovered nine additional npm packages linked to the same operation, which it has now removed from npm.
About this happening:
The indexed-btree npm malware campaign expanded to nine additional packages linked to the same operation, widening exposure across the npm ecosystem. The packages impe...
Indexed-btree linked npm malware campaign
CampaignHow related: Checkmarx also discovered nine additional npm packages linked to the same operation, which it has now removed from npm.
About this happening: The indexed-btree npm malware campaign expanded to nine additional packages linked to the same operation, widening exposure across the npm ecosystem. The packages impe...
WeaselBiscuit stealer delivered via 13 npm packages
Malware Activity
H score30
First: 18.09.2026 13:40
Last: 18.09.2026 13:40
Sources 1
About this happening:
The WeaselBiscuit stealer was found in 13 npm packages, expanding supply-chain risk to developer environments and extension data theft. The malware is triggered by an npm...
WeaselBiscuit stealer delivered via 13 npm packages
Malware ActivityAbout this happening: The WeaselBiscuit stealer was found in 13 npm packages, expanding supply-chain risk to developer environments and extension data theft. The malware is triggered by an npm...
North Korean npm developer-targeting blockchain-C2 campaign
Campaign
H score41
First: 29.07.2026 07:20
Last: 29.07.2026 07:20
Sources 1
About this happening:
An ongoing North Korean npm supply-chain campaign is delivering DEV#POPPER-linked payloads through compromised @joyfill packages, exposing developers to remote acces...
North Korean npm developer-targeting blockchain-C2 campaign
CampaignAbout this happening: An ongoing North Korean npm supply-chain campaign is delivering DEV#POPPER-linked payloads through compromised @joyfill packages, exposing developers to remote acces...
ViteVenom malicious npm packages delivering blockchain-backed RAT
Malware Activity
H score3
First: 17.07.2026 21:54
Last: 17.07.2026 21:54
Sources 1
About this happening:
A cluster of seven malicious npm packages has targeted the Vite frontend ecosystem, delivering a blockchain-backed RAT loader that can harvest credentials and exfiltra...
ViteVenom malicious npm packages delivering blockchain-backed RAT
Malware ActivityAbout this happening: A cluster of seven malicious npm packages has targeted the Vite frontend ecosystem, delivering a blockchain-backed RAT loader that can harvest credentials and exfiltra...
Timeline
-
20.09.2026 17:11 3 articles · 13d ago
Checkmarx finds indexed-btree hiding a runtime loader to evade npm v12 defenses
Initial DisclosureCheckmarx researchers found the malicious indexed-btree npm package impersonating sorted-btree and hiding its loader in BTree.prototype.set(), so a normal runtime call can trigger sharedLoad.min.js and bypass npm v12 install-script defenses. The package can collect system details and exfiltrate them through hardcoded Slack and Telegram channels, poll an Ethereum smart contract on the Sepolia test network for command-and-control data, and the same operation also includes nine additional npm packages that Checkmarx removed from npm.
Show sources
- Malicious npm packages evade install-script defenses at runtime — www.bleepingcomputer.com — 20.09.2026 17:11
- Malicious npm packages evade install-script defenses at runtime — www.bleepingcomputer.com — 20.09.2026 17:11
- Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal — thehackernews.com — 22.09.2026 12:38