Researchers at Checkmarx have detailed a malicious npm package that skips install hooks entirely, running its payload from ordinary library code instead.
The package, indexed-btree, mimics a legitimate B-tree and indexing utility called sorted-btree. It was uploaded on June 18, 2026 by an account named charlessadler25, drew roughly two million downloads a week, and was removed on September 3 – about eleven weeks after the first bad version went live.
The trigger sat in a normal method
Rather than a preinstall or postinstall script, the trigger lives in the library’s BTree.prototype.set method. Given a particular key value, it launches an obfuscated first-stage loader as a detached Node.js process. The loader profiles the host – architecture, hostname, CPU, memory and uptime – and ships the results out through a hardcoded Slack channel and Telegram bot.
Command and control hides in a smart contract on the Sepolia Ethereum testnet. The malware polls the contract’s getter and setter functions instead of a fixed domain, so a takedown only means the operators point the contract at a new address. It then derives a shared secret and unlocks a second stage from encrypted chunks stored on-chain, before deleting its files and stripping the trigger out of the package code.
Nine more packages on the same rails
Checkmarx linked nine more packages to the same operation, including btree-core at more than 1.9 million downloads. The operators kept a tidy GitHub repository with real commits and an AI-generated avatar, hiding the malicious code from it, and had already earned 109 ETH – close to $300,000.
Blocking lifecycle scripts, the researchers conclude, changed attacker behavior rather than removing the threat. Runtime analysis now matters as much as install-time scanning.
