indexed-btree npm Package Executes Malware Loader Inside BTree.prototype.set() After npm 12 Lifecycle Restrictions

Checkmarx identified indexed-btree as a counterfeit of sorted-btree that performed all malicious activity at runtime. The set() method triggered sharedLoad.min.js, which loaded an obfuscated first stage that fingerprinted the host and retrieved encrypted blobs from a Sepolia smart contract. The campaign also published at least nine related packages, all since deleted, and accumulated millions of downloads in weeks.

npm 12's restriction on preinstall and postinstall scripts forced the shift. Technical telemetry shows the malware deleted its own artifacts and removed the trigger code after execution, a deliberate anti-forensics step not present in earlier lifecycle-script campaigns. This matches patterns seen in prior supply-chain operations where defenders blocked one vector and actors immediately relocated execution into application code.

The episode parallels the Comment2Shell WordPress exploitation, where a known input-handling flaw continued to yield remote code execution after patches because organizations relied on static detection rather than runtime behavioral controls. Both cases demonstrate that mitigation of one attack surface simply moves malicious behavior elsewhere unless layered monitoring is applied.

Developers must now instrument runtime behavior analysis across dependency graphs. Procurement records and contract awards for similar runtime monitoring tools indicate this requirement will spread to CI pipelines within the next two quarters.