Malicious npm packages bypass new security defenses by hiding code in runtime behavior

Campaign impersonating 'sorted-btree' library accumulates 2 million weekly downloads, using Ethereum smart contracts for command-and-control

edit
By LineZotpaper
Published
Read Time2 min
Security researchers have uncovered an ongoing npm malware campaign that sidesteps GitHub’s latest supply-chain protections by concealing malicious code in a package’s runtime execution rather than installation scripts. The package 'indexed-btree', which impersonates the legitimate 'sorted-btree' library, has amassed 2 million weekly downloads and uses an Ethereum smart contract on the Sepolia test network to receive commands, according to Checkmarx.

The campaign, detected by Checkmarx researchers, exploits a gap in the security measures GitHub introduced in June 2026. Those measures block dependency lifecycle scripts such as 'preinstall', 'install', and 'postinstall' unless explicitly approved, and prevent npm from automatically fetching dependencies from Git repositories or remote URLs without permission.

By avoiding installation scripts entirely, 'indexed-btree' triggers no npm v12 approval mechanisms. Instead, its malicious loader hides inside the BTree.prototype.set() method, which executes at runtime when an application calls it with a specific key value.

"The malware loader hides inside the library’s own BTree.prototype.set method, which is the main function that every user would call constantly," Checkmarx explained. "This triggers the sharedLoad.min.js, which contains the obfuscated first stage of the malware."

Once activated, the malware collects system information—architecture, hostname, CPU, memory, and uptime—and exfiltrates it via hardcoded Slack and Telegram channels. It also polls an Ethereum smart contract for command-and-control data, using X25519 key exchange to derive an AES key and decrypt a second-stage payload stored in the contract. When operators choose to end the attack, the malware can delete its files and remove the malicious trigger to wipe traces.

The threat actors built a legitimate-looking GitHub repository with fabricated commit history and curated the developer account to appear trustworthy. Checkmarx identified nine additional npm packages linked to the same operation, which have since been removed from npm. The attackers may have generated significant profits—a wallet reportedly holding 109 ETH was associated with the campaign, though the researchers did not confirm those funds came from cryptocurrency theft.

§

Analysis

Why This Matters

  • This campaign demonstrates that blocking install scripts alone is insufficient against sophisticated supply-chain attacks, as malware can be hidden in runtime code that executes during normal package use.
  • The use of an Ethereum smart contract for C2 represents an evolution in attacker infrastructure, making takedowns more difficult and communication more resilient.
  • With 2 million weekly downloads, the reach of this campaign underscores the ongoing challenge of securing open-source ecosystems that trust packages based on appearance and popularity.

Background

Open-source package registries like npm have been frequent targets for supply-chain attacks, with several high-profile incidents prior to 2026. In June 2026, GitHub introduced enhanced npm security measures—primarily blocking lifecycle scripts—to address this threat. However, attackers continually adapt, and the indexed-btree campaign shows they can achieve remote code execution without triggering those defenses by embedding malicious logic in everyday function calls.

Key Perspectives

Security Researchers (Checkmarx): The discovery highlights a blind spot in current defenses. Runtime-based malware that triggers only when specific function arguments are provided can evade static analysis and taint-tracking tools, requiring deeper runtime monitoring or behavioral detection.

npm/GitHub Maintainers: The platform’s new security measures raised the bar against traditional install-script attacks. This campaign represents an evasion technique that the community must now address—possibly through runtime sandboxing or attestation mechanisms.

Developers and Organizations: Users of open-source libraries face increased risk when relying solely on download counts or surface-level reviews as trust signals. The campaign’s use of fake commit history and a plausible-looking repository makes manual vetting harder. Adopting software composition analysis and runtime monitoring may become necessary.

What to Watch

  • Whether npm or GitHub announce additional runtime protections, such as restricting dynamic code execution or introducing behavioral monitoring.
  • Any disclosure of second-stage payloads found in the Ethereum smart contract, which could reveal the campaign’s ultimate objective (data theft, cryptomining, or ransomware).
  • The fate of the 109 ETH wallet: if funds are moved to exchanges, it may provide attribution leads.

Sources

newspaper

Zotpaper

Articles published under the Zotpaper byline are synthesized from multiple source publications by our AI editor and reviewed by our editorial process. Each story combines reporting from credible outlets to give readers a balanced, comprehensive view.