The campaign, detected by Checkmarx researchers, exploits a gap in the security measures GitHub introduced in June 2026. Those measures block dependency lifecycle scripts such as 'preinstall', 'install', and 'postinstall' unless explicitly approved, and prevent npm from automatically fetching dependencies from Git repositories or remote URLs without permission.
By avoiding installation scripts entirely, 'indexed-btree' triggers no npm v12 approval mechanisms. Instead, its malicious loader hides inside the BTree.prototype.set() method, which executes at runtime when an application calls it with a specific key value.
"The malware loader hides inside the library’s own BTree.prototype.set method, which is the main function that every user would call constantly," Checkmarx explained. "This triggers the sharedLoad.min.js, which contains the obfuscated first stage of the malware."
Once activated, the malware collects system information—architecture, hostname, CPU, memory, and uptime—and exfiltrates it via hardcoded Slack and Telegram channels. It also polls an Ethereum smart contract for command-and-control data, using X25519 key exchange to derive an AES key and decrypt a second-stage payload stored in the contract. When operators choose to end the attack, the malware can delete its files and remove the malicious trigger to wipe traces.
The threat actors built a legitimate-looking GitHub repository with fabricated commit history and curated the developer account to appear trustworthy. Checkmarx identified nine additional npm packages linked to the same operation, which have since been removed from npm. The attackers may have generated significant profits—a wallet reportedly holding 109 ETH was associated with the campaign, though the researchers did not confirm those funds came from cryptocurrency theft.