An ongoing npm malware campaign involving the '**indexed-btree**' package demonstrates a concerning evolution in threat actor tactics, as it successfully bypasses supply chain defenses by concealing malicious code within a package's normal runtime behavior rather than in installation scripts. The package, identified by **Checkmarx** researchers, attempts to impersonate the legitimate '**sorted-btree**' library and has already accumulated over 2 million weekly downloads. While **Checkmarx** suggests the campaign may have generated significant profits for the attackers, noting a wallet holding 109 ETH, the report does not definitively link these funds to cryptocurrency theft. ## Bypassing Latest Security Measures In June 2026, **GitHub** introduced a suite of npm security measures designed to combat the persistent supply chain attacks plaguing open-source ecosystems since late 2025. A cornerstone of these measures was the blocking of dependency lifecycle scripts, such as 'preinstall', 'install', and 'postinstall', unless explicitly approved. Other protections prevent npm from automatically retrieving dependencies from Git repositories or remote URLs without explicit permission. However, the malicious **indexed-btree** package cleverly sidesteps these protections. Instead of relying on installation scripts, it hides its loader within the package's `BTree.prototype.set()` method. This method executes at runtime when the application calls it with a specific key value, making the installation appear clean and circumventing npm v12's approval mechanisms. "The malware loader hides inside the library's own `BTree.prototype.set` method, which is the main function that every user would call constantly," explains **Checkmarx**. "This triggers the `sharedLoad.min.js`, which contains the obfuscated first stage of the malware. This is a well-built way to sneak past standard taint-analysis tools and most static scanners."  Once executed, the malware initiates a data collection process, gathering system details such as architecture, hostname, CPU, memory, and uptime. This information is then exfiltrated via hardcoded Slack and Telegram channels. The malware also communicates with an Ethereum smart contract on the Sepolia test network for command-and-control (C2) information. It employs **X25519** key exchange to derive an **AES** key, which is then used to decrypt a second-stage payload stored within the contract. For operational security, the malware is designed to remove its traces. When instructed by operators, it can delete its files and remove the malicious trigger from the package code. Researchers noted the extensive efforts by threat actors to legitimize the project. This included creating a convincing **GitHub** repository, populating its commit history, and curating a seemingly legitimate developer account.  **Checkmarx** also identified nine additional npm packages linked to the same operation, which have since been removed from npm. These packages also garnered significant download numbers: 1. ordered-kv-index (448,184 downloads) 2. btree-leaderboard (493,685 downloads) 3. priority-slot-queue (402,860 downloads) 4. btree-range-store (468,092 downloads) 5. btree-core (1,951,274 downloads) 6. btree-time-index (425,312 downloads) 7. btree-lru-cache (372,185 downloads) 8. neighbor-key-map (366,019 downloads) 9. sliding-score-window (448,024 downloads) Developers are strongly advised against relying solely on install-time scanning and should instead incorporate runtime behavioral analysis into their security protocols. Organizations that have installed **indexed-btree** or any of the aforementioned packages should immediately rotate all secrets and restore their development environments from a trusted backup.