LmCast :: Stay tuned in

Malicious npm packages evade install-script defenses at runtime

Recorded: Sept. 20, 2026, 3 p.m.

Original Summarized

Malicious npm packages evade install-script defenses at runtime

News

Featured
Latest

OpenAI details more cases of AI agents taking unauthorized actions

Brevo supply-chain attack injected ClickFix scripts on customer sites

Cisco warns of max severity ISE zero-day exploited in attacks

Microsoft shares workaround for Windows domain login issues

Malicious npm packages evade install-script defenses at runtime

Own 88 hours of AI & cybersecurity training for just $29.99

Researchers escape OpenAI Codex sandbox to run commands on host

BragJack attacks hijack AI browser agents through malicious extensions

Tutorials

Latest
Popular

How to access the Dark Web using the Tor Browser

How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11

How to use the Windows Registry Editor

How to backup and restore the Windows Registry

How to start Windows in Safe Mode

How to remove a Trojan, Virus, Worm, or other Malware

How to show hidden files in Windows 7

How to see hidden files in Windows

Webinars
Downloads

Latest
Most Downloaded

Qualys BrowserCheck

STOPDecrypter

AuroraDecrypter

FilesLockerDecrypter

AdwCleaner

ComboFix

RKill

Junkware Removal Tool

Deals

Categories

eLearning

IT Certification Courses

Gear + Gadgets

Security

VPNs

Popular

Best VPNs

How to change IP address

Access the dark web safely

Best VPN for YouTube

Forums
More

Virus Removal Guides
Startup Database
Uninstall Database
Glossary
Send us a Tip!
Welcome Guide

HomeNewsSecurityMalicious npm packages evade install-script defenses at runtime

Malicious npm packages evade install-script defenses at runtime

By Bill Toulas

September 20, 2026
10:11 AM
0

An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by hiding malicious code in a package's normal runtime behavior rather than in installation scripts.
The package, spotted by Checkmarx researchers, attempts to impersonate the legitimate 'sorted-btree' library and has already amassed 2 million weekly downloads.
The campaign may also have generated significant profits for the attackers, who, according to Checkmarx, use a wallet holding 109 ETH. However, the report does not say those funds came from cryptocurrency theft.
Bypassing latest security measures
In June 2026, GitHub announced a set of npm security measures designed to help prevent supply chain attacks that have shaken open-source ecosystems repeatedly since late 2025.
One key security measure is to block dependency lifecycle scripts such as 'preinstall', 'install ', and 'postinstall,' unless explicitly approved.
Other measures prevent npm from automatically retrieving dependencies from Git repositories or remote URLs without permission.
The malicious indexed-btree package sidesteps these protections by avoiding installation scripts and instead hiding its loader in the package's BTree.prototype.set() method, which executes at runtime when the application calls it with a specific key value.
As a result, installation appears clean and triggers none of npm v12's approval mechanisms.
"The malware loader hides inside the library's own BTree.prototype.set method, which is the main function that every user would call constantly," explains Checkmarx.
"This triggers the sharedLoad.min.js, which contains the obfuscated first stage of the malware. This is a well-built way to sneak past standard taint-analysis tools and most static scanners."

The malicious runtime triggerSource: Checkmarx
Once the malware is executed, it can collect system details, including architecture, hostname, CPU, memory, and uptime, and exfiltrate the information through hardcoded Slack and Telegram channels.
The malware also polls an Ethereum smart contract on the Sepolia test network for command-and-control (C2) information. It uses X25519 key exchange to derive an AES key and decrypt a second-stage payload stored in the contract.
When the operators choose to end the attack, the malware can delete its files and remove the malicious trigger from the package code to wipe its traces.
The researchers note that the threat actors have gone to great lengths to make the project appear legitimate, including building a legitimate-looking GitHub repository, populating its commit history, and curating the developer account.

Fabricated commit historySource: Checkmarx
Checkmarx also discovered nine additional npm packages linked to the same operation, which it has now removed from npm. Those also achieved significant download numbers, as seen here:
ordered-kv-index (448,184 downloads)
btree-leaderboard (493,685 downloads)
priority-slot-queue (402,860 downloads)
btree-range-store (468,092 downloads)
btree-core (1,951,274 downloads)
btree-time-index (425,312 downloads)
btree-lru-cache (372,185 downloads)
neighbor-key-map (366,019 downloads)
sliding-score-window (448,024 downloads)
Developers are advised not to rely on install-time scanning alone, and to also employ runtime behavioral analysis.
Those who installed indexed-btree or any of the above-listed packages should rotate all secrets and restore their development environment from a safe backup.

Build your security blueprint for AI-powered attacks

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Save your seat

Related Articles:
Fake LastPass Authenticator GitHub repos push new Rapuncel infostealerAmazon links Debug, Chalk NPM supply-chain attacks to North Korean hackersFakeGit campaign uses 7,600 GitHub repos to push SmartLoader malwareNew RatHat Android malware uses AI to automate device controlIranian hackers use CHOSEN BRICK Windows malware to spy on targets

GitHub
Malware
npm
Packages
Security Bypass

Bill Toulas
Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks.

Previous Article

Post a Comment Community Rules

You need to login in order to post a comment
Not a member yet? Register Now

You may also like:

  Upcoming Webinar

Popular Stories

Cisco warns of max severity ISE zero-day exploited in attacks

Microsoft shares workaround for Windows domain login issues

Brevo supply-chain attack injected ClickFix scripts on customer sites

Sponsor Posts

Overdue a password health-check? Audit your Active Directory for free

Patch automation needs more than speed. Action1 brings control into every stage of deployment.

Automate Onboarding and Access Reviews with No-Code IGA: See how it works

Watch a working exploit hit live controls and see exactly what blocks, detects, or misses

Find out how long recovery really takes — and what it costs. Read the 2025 BCDR Report.

  Upcoming Webinar

Follow us:

Main Sections

News
Webinars
VPN Buyer Guides
SysAdmin Software Guides
Downloads
Virus Removal Guides
Tutorials
Startup Database
Uninstall Database
Glossary

Community

Forums
Forum Rules
Chat

Useful Resources

Welcome Guide
Sitemap

Company

About BleepingComputer
Contact Us
Send us a Tip!
Advertising
Write for BleepingComputer
Social & Feeds
Changelog

Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure

Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved

Login

Username

Password

Remember Me

Sign in anonymously

Sign in with Twitter

Not a member yet? Register Now


Reporter

Help us understand the problem. What is going on with this comment?

Spam

Abusive or Harmful

Inappropriate content

Strong language

Other

Read our posting guidelinese to learn what content is prohibited.

Submitting...
SUBMIT

An ongoing campaign targeting the npm ecosystem has demonstrated how threat actors can circumvent supply chain defenses by embedding malicious code within a package's normal runtime behavior rather than exploiting installation scripts. Researchers at Checkmarx identified this method in the 'indexed-btree' package, which attempted to impersonate the legitimate 'sorted-btree' library and had amassed two million weekly downloads. This activity was linked to attackers who reportedly generated significant profit, with reports noting they held 109 ETH in a wallet, although the source of these funds was not specified as cryptocurrency theft.

To evade recently implemented npm security measures—which aim to block malicious code within dependency lifecycle scripts like preinstall, install, and postinstall, and prevent unauthorized dependency fetching—the malicious package concealed its malicious loader within the BTree.prototype.set() method. This method is a frequently called function, meaning the malicious code executes at runtime whenever an application interacts with it using a specific key value. This execution triggers the loading of a file named sharedLoad.min.js, which contains the initial stage of the malware payload, allowing it to bypass standard taint analysis tools and most static scanners.

Once executed, the malware’s function is to collect comprehensive system details, including the architecture, hostname, CPU information, memory statistics, and uptime of the host system. This gathered information is then exfiltrated by forwarding it through hardcoded channels to Slack and Telegram. Furthermore, the malicious code engages in command-and-control activities by polling an Ethereum smart contract on the Sepolia test network to retrieve further instructions. The malware utilizes X25519 key exchange to derive an AES key, which is then used to decrypt a second-stage payload stored within the smart contract. The threat actors possess a mechanism to erase their presence by deleting files and removing the malicious trigger from the package code when they conclude the operation.

The sophistication of the threat actors is further illustrated by their efforts to establish credibility, which included creating a legitimate-looking GitHub repository, populating its commit history, and curating the developer account associated with the package. Checkmarx also uncovered nine additional npm packages linked to this same operation that displayed substantial download numbers, including ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, and sliding-score-window.

As a result of these findings, security experts advise that relying solely on installation-time scanning is insufficient for detecting supply chain threats. There is an increased emphasis on employing runtime behavioral analysis to monitor application execution for suspicious activities. Developers who have introduced packages like indexed-btree or any of the other identified malicious packages are strongly recommended to rotate all secrets and restore their development environment from a secure backup to mitigate potential exposure.