Indexed-btree npm runtime malware activity
Malware Activity
Summary
Hide ▲
Show ▼
The indexed-btree npm package is an ongoing malware activity that hides a loader in normal runtime code to evade supply-chain defenses and reach developer environments at execution time. The package impersonates sorted-btree, has about 2 million weekly downloads, and can collect host details before exfiltrating them through Slack and Telegram. It also polls a Sepolia smart contract for C2 data and can stage a second payload.
Related Happenings
Indexed-btree linked npm malware campaign
Campaign
H score26
First: 20.09.2026 17:11
Last: 20.09.2026 17:11
Sources 1
How related:
Checkmarx also discovered nine additional npm packages linked to the same operation, which it has now removed from npm.
About this happening:
The indexed-btree npm malware campaign expanded to nine additional packages linked to the same operation, widening exposure across the npm ecosystem. The packages impe...
Indexed-btree linked npm malware campaign
CampaignHow related: Checkmarx also discovered nine additional npm packages linked to the same operation, which it has now removed from npm.
About this happening: The indexed-btree npm malware campaign expanded to nine additional packages linked to the same operation, widening exposure across the npm ecosystem. The packages impe...
WeaselBiscuit stealer delivered via 13 npm packages
Malware Activity
H score30
First: 18.09.2026 13:40
Last: 18.09.2026 13:40
Sources 1
About this happening:
The WeaselBiscuit stealer was found in 13 npm packages, expanding supply-chain risk to developer environments and extension data theft. The malware is triggered by an npm...
WeaselBiscuit stealer delivered via 13 npm packages
Malware ActivityAbout this happening: The WeaselBiscuit stealer was found in 13 npm packages, expanding supply-chain risk to developer environments and extension data theft. The malware is triggered by an npm...
North Korean npm developer-targeting blockchain-C2 campaign
Campaign
H score41
First: 29.07.2026 07:20
Last: 29.07.2026 07:20
Sources 1
About this happening:
An ongoing North Korean npm supply-chain campaign is delivering DEV#POPPER-linked payloads through compromised @joyfill packages, exposing developers to remote acces...
North Korean npm developer-targeting blockchain-C2 campaign
CampaignAbout this happening: An ongoing North Korean npm supply-chain campaign is delivering DEV#POPPER-linked payloads through compromised @joyfill packages, exposing developers to remote acces...
ViteVenom malicious npm packages delivering blockchain-backed RAT
Malware Activity
H score3
First: 17.07.2026 21:54
Last: 17.07.2026 21:54
Sources 1
About this happening:
A cluster of seven malicious npm packages has targeted the Vite frontend ecosystem, delivering a blockchain-backed RAT loader that can harvest credentials and exfiltra...
ViteVenom malicious npm packages delivering blockchain-backed RAT
Malware ActivityAbout this happening: A cluster of seven malicious npm packages has targeted the Vite frontend ecosystem, delivering a blockchain-backed RAT loader that can harvest credentials and exfiltra...
SuccessKey ViteVenom ChainVeil supply-chain campaign targeting Vite developers
Campaign
H score8
First: 17.07.2026 21:54
Last: 17.07.2026 21:54
Sources 1
About this happening:
The SuccessKey-linked ViteVenom campaign is targeting Vite developers with seven malicious npm packages and a blockchain-based C2 path that delivers a RAT....
SuccessKey ViteVenom ChainVeil supply-chain campaign targeting Vite developers
CampaignAbout this happening: The SuccessKey-linked ViteVenom campaign is targeting Vite developers with seven malicious npm packages and a blockchain-based C2 path that delivers a RAT....
Timeline
-
20.09.2026 17:11 2 articles · 1h ago
Checkmarx finds indexed-btree hiding a runtime loader to evade npm v12 defenses
Initial DisclosureCheckmarx researchers found the malicious indexed-btree npm package impersonating sorted-btree and hiding its loader in BTree.prototype.set(), so a normal runtime call can trigger sharedLoad.min.js and bypass npm v12 install-script defenses. The package can collect system details and exfiltrate them through hardcoded Slack and Telegram channels, poll an Ethereum smart contract on the Sepolia test network for command-and-control data, and the same operation also includes nine additional npm packages that Checkmarx removed from npm.
Show sources
- Malicious npm packages evade install-script defenses at runtime — www.bleepingcomputer.com — 20.09.2026 17:11
- Malicious npm packages evade install-script defenses at runtime — www.bleepingcomputer.com — 20.09.2026 17:11