NPM Indexed-BTRee Malware: How Attackers Evolved Beyond Install Scripts
In June 2026, threat actors deployed a sophisticated supply chain attack through the malicious npm package 'indexed-btree,' which mimicked the legitimate 'sorted-btree' package. Unlike traditional attacks that rely on install scripts, this campaign embedded malware directly within application runtime code, specifically in the BTree.prototype.set() method. The malware performed host fingerprinting, communicated via Slack and Telegram channels, and used the EtherHiding technique to retrieve encrypted payloads from Ethereum smart contracts. The campaign generated approximately €230,933 in cryptocurrency profits and affected millions of downloads before removal. This incident demonstrates how attackers are rapidly adapting to npm's version 12 security controls that restrict automatic execution of lifecycle scripts. The shift toward runtime-based malware delivery represents a significant evolution in supply chain attack methodologies, requiring defenders to implement layered security controls beyond traditional install-time scanning.
Kill Chain
