The indexed-btree npm campaign hides malicious code in normal runtime behavior to bypass new GitHub and npm supply chain defenses, while impersonating the legitimate sorted-btree library. Checkmarx found the package and nine related npm packages, which exposed victims to data theft, C2 activity through Slack, Telegram, and an Ethereum smart contract, and possible trace removal by the attackers. #indexed-btree #sorted-btree #Checkmarx #GitHub #npm #Sepolia
Keypoints
- indexed-btree impersonates the legitimate sorted-btree library.
- The malware avoids install scripts and triggers at runtime through BTree.prototype.set().
- GitHub’s new npm protections are bypassed because installation appears clean.
- The payload collects system details and exfiltrates them via Slack and Telegram.
- Checkmarx removed nine related npm packages and advises runtime behavioral analysis.