Reported by 4 outlets

Timeline

1. original reporting

   🚨 npm supply-chain malware is moving beyond install scripts. The malicious `indexed-btree` package reached nearly 2M weekly downloads while

   thecybersecguru.com · 23d ago · September 20th, 2026

   🚨 npm supply-chain malware is moving beyond install scripts. The malicious indexed-btree package reached nearly 2M weekly downloads while

   via Mastodon https://thecybersecguru.com/news/indexed-btree-npm-malware-runtime-attack-bypasses-npm-v12/

2. update from bleepingcomputer.com

   Malicious npm packages evade install-script defenses at runtime

   bleepingcomputer.com · 23d ago · September 20th, 2026

   An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by hiding malicious code in a package's normal runtime behavior rather than in installation scripts. The package, spotted by Checkmarx researchers, attempts to impersonate the legitimate 'sorted-btree' library and has already amassed 2 million weekly downloads. The campaign may also have generated significant profits for the attackers, who, according to Checkmarx, use a wallet holding 109 ETH. However, the report does not say those funds came from cryptocurrency theft. Bypassing latest security measures In June 2026, GitHub announced a set of npm security measures designed to help prevent supply chain attacks that have shaken open-source ecosystems repeatedly since late 2025. One key security measure is to block dependency lifecycle scripts such as 'preinstall', 'install ', and 'postinstall,' unless explicitly approved. Other measures prevent npm from automatically retrieving dependencies from Git repositories or remote URLs without permission. The malicious indexed-btree package sidesteps these protections by avoiding installation scripts and instead hiding its loader in the package's BTree.prototype.set() method, which executes at runtime when the application calls it with a specific key value. As a result, installation appears clean and triggers none of npm v12's approval mechanisms. "The malware loader hides inside the library's own BTree.prototype.se

3. update from www.bleepingcomputer.com

   Malicious npm packages evade install-script defenses at runtime https:// bleepingcomputer.com/news/security/ malicious-npm-packages-evade-in

   www.bleepingcomputer.com · 23d ago · September 20th, 2026

   Malicious npm packages evade install-script defenses at runtime https:// bleepingcomputer.com/news/security/ malicious-npm-packages-evade-in

   via X https://www.bleepingcomputer.com/news/security/malicious-npm-packages-evade-install-script-defenses-at-runtime/

4. mentioned by www.bleepingcomputer.com

   🤖 Malicious npm 'indexed-btree' (2M weekly downloads) impersonates 'sorted-btree'. Loader hidden in BTree.prototype.set() runs at runtime, b

   www.bleepingcomputer.com · 23d ago · September 20th, 2026

5. update from dev.to

   indexed-btree: npm Supply Chain Malware Executes at Runtime and Uses a Smart Contract on Ethereum Sepolia for C2 # security # threatintel #

   dev.to · 23d ago · September 21st, 2026

   indexed-btree: npm Supply Chain Malware Executes at Runtime and Uses a Smart Contract on Ethereum Sepolia for C2 # security # threatintel #

   via Mastodon https://dev.to/anoymask/indexed-btree-npm-supply-chain-malware-executes-at-runtime-and-uses-a-smart-contract-on-ethereum-d83

6. mentioned by www.bleepingcomputer.com

   🤖 Supply-chain: malicious npm package 'indexed-btree' hides its payload in runtime behavior, bypassing install-script sandbox defenses. Ongo

   www.bleepingcomputer.com · 23d ago · September 21st, 2026

7. mentioned by www.bleepingcomputer.com

   Malicious # npm packages evade install-script defenses at runtime https://www. bleepingcomputer.com/news/secu rity/malicious-npm-packages-ev

   www.bleepingcomputer.com · 22d ago · September 21st, 2026