THE NPM ecosystem has been hit by an ongoing supply-chain campaign involving the malicious package `indexed-btree`, according to Checkmarx. The package imitates the legitimate `sorted-btree` utility and reached 2 million weekly downloads before detection. Rather than using an install script, which security tools may detect, the attacker hid the trigger in the library’s JavaScript prototype code.
A seemingly legitimate GitHub repository, complete with numerous commits, was also created to build trust; the repository reportedly did not contain the malicious code.
The malware is embedded in the library’s main `BTree.prototype.set` method. When triggered, it gathers system information and sends it to a hardcoded Slack channel and Telegram chat. It then connects to a blockchain contract on the Sepolia network serving as command and control, extracts and decrypts a second-stage payload from the contract, and removes traces of its activity.
Checkmarx said the same smart contract had previously been found in the `mutex-forge` package and that the threat actor appears to have made 109 ETH, worth nearly $300,000.
Other packages linked to the campaign include `ordered-kv-index`, `btree-leaderboard`, `priority-slot-queue`, `btree-range-store`, `btree-core`, `btree-time-index`, `btree-lru-cache`, `neighbor-key-map` and `sliding-score-window`. These packages had more than 5 million downloads when removed. Organisations using the packages should identify and remove affected dependencies and investigate systems where they were installed or executed.