Executive Summary
In June 2026, threat actors deployed a sophisticated supply chain attack through the malicious npm package 'indexed-btree,' which mimicked the legitimate 'sorted-btree' package. Unlike traditional attacks that rely on install scripts, this campaign embedded malware directly within application runtime code, specifically in the BTree.prototype.set() method. The malware performed host fingerprinting, communicated via Slack and Telegram channels, and used the EtherHiding technique to retrieve encrypted payloads from Ethereum smart contracts. The campaign generated approximately €230,933 in cryptocurrency profits and affected millions of downloads before removal. This incident demonstrates how attackers are rapidly adapting to npm's version 12 security controls that restrict automatic execution of lifecycle scripts. The shift toward runtime-based malware delivery represents a significant evolution in supply chain attack methodologies, requiring defenders to implement layered security controls beyond traditional install-time scanning.
Why This Matters Now
This attack represents a critical evolution in supply chain threats as attackers immediately adapted to npm v12's lifecycle script restrictions by moving malware execution to runtime code, demonstrating the need for behavioral analysis beyond install-time security measures.
Attack Path Analysis
Threat actors compromised the npm supply chain by uploading malicious packages mimicking legitimate B-tree utilities, executing malware through runtime code instead of lifecycle scripts. The malware fingerprinted hosts, established command and control via Slack/Telegram channels, and used EtherHiding technique to retrieve encrypted payloads from smart contracts, ultimately generating cryptocurrency profits while evading detection through code obfuscation and artifact cleanup.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Threat actor uploaded malicious npm package 'indexed-btree' mimicking legitimate 'sorted-btree' package, bypassing npm v12 lifecycle script restrictions by embedding malware directly in BTree.prototype.set() method
MITRE ATT&CK® Techniques
Supply Chain Compromise: Compromise Software Supply Chain
Masquerading: Match Legitimate Name or Location
Obfuscated Files or Information
System Information Discovery
Web Service: Bidirectional Communication
Web Service: One-Way Communication
Deobfuscate/Decode Files or Information
Indicator Removal on Host: File Deletion
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
CISA Zero Trust Maturity Model 2.0 – Application Security Testing
Control ID: Applications and Workloads - AW.L2
NIST Cybersecurity Framework 2.0 – Suppliers and Third-Party Partners
Control ID: ID.SC-4
Digital Operational Resilience Act (DORA) – Third-Party Risk Management
Control ID: Article 28
NIS2 Directive – Supply Chain Security
Control ID: Article 21.2(a)
ISO 27001:2022 – Information Security Policy for Supplier Relationships
Control ID: A.15.1.1
NYDFS 23 NYCRR 500 – Third-Party Service Provider Security Policy
Control ID: 500.11
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Supply chain attacks targeting npm packages directly threaten software development workflows, requiring runtime behavior analysis and enhanced package validation protocols.
Information Technology/IT
Malicious npm packages bypassing lifecycle script protections expose IT infrastructure to cryptocurrency mining, data exfiltration, and compromised development environments.
Banking/Mortgage
Financial institutions face regulatory compliance violations and data breach risks from compromised development tools enabling lateral movement and encrypted traffic exfiltration.
Computer/Network Security
Security vendors must adapt detection capabilities for runtime-embedded malware that evades traditional install-time scanning and employs blockchain-based payload delivery.
Sources
- Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removalhttps://thehackernews.com/2026/09/malicious-npm-package-indexed-btree-hid.htmlVerified
- NPM Btree Malware Campaign Affects Millions of Downloads - No Need for Install Scripthttps://checkmarx.com/zero-post/npm-btree-malware-campaign-affects-millions-of-downloads-no-need-for-install-script/Verified
- NPM v12 Lifecycle Script Limits - A Real Malicious Package Risk Reduction or Just Moving Risk Around?https://checkmarx.com/zero-post/npm-v12-lifecycle-script-limits-a-real-malicious-package-risk-reduction-or-just-moving-risk-around/Verified
- PolinRider GitHub Packagist Supply Chain Attack Analysishttps://socket.dev/blog/polinrider-github-packagistVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely reduce the blast radius of this npm supply chain attack by constraining lateral movement between compromised developer environments and limiting outbound communications to attacker-controlled channels through segmented network enforcement.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Zero Trust segmentation would likely constrain the malicious package's ability to communicate across workload boundaries, limiting its reach within containerized development environments and reducing cross-service exposure during initial execution.
Control: Zero Trust Segmentation
Mitigation: Workload isolation policies would likely limit the malware's ability to escalate privileges across segmented development environments, constraining its access to resources beyond the immediate execution context and reducing cross-workload privilege expansion.
Control: East-West Traffic Security
Mitigation: Microsegmentation enforcement would likely constrain lateral movement between compromised developer workloads and repositories, reducing the campaign's ability to spread across different development environments and limiting cross-repository infection paths through controlled east-west traffic flows.
Control: Multicloud Visibility & Control
Mitigation: Network visibility and control policies would likely detect and constrain unauthorized communications to external C2 channels, limiting the malware's ability to establish persistent command channels and reducing its operational control across distributed development environments.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress policies would likely limit unauthorized data exfiltration to external channels, constraining the malware's ability to beacon host information and reducing the scope of sensitive data exposure through restricted outbound communication paths.
Zero Trust segmentation would likely reduce the overall blast radius of the supply chain compromise, limiting the scope of affected development environments and constraining the campaign's reach across segmented infrastructure boundaries.
Impact at a Glance
Affected Business Functions
- Software Development and CI/CD Pipelines
- Application Deployment Infrastructure
- Cryptocurrency and Digital Asset Management
- Source Code Integrity and Version Control
Estimated downtime: 7 days
Estimated loss: $328,500
Developer environment credentials, source code repositories, cryptocurrency wallets, and private keys. The malware performed host fingerprinting and exfiltrated system information via Slack channels and Telegram bots. Additional exposure includes compromised GitHub accounts, package registry credentials, and potential access to proprietary application code for organizations that installed the malicious packages.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Cloud Native Security Fabric (CNSF) for runtime inspection and anomaly detection to identify malicious behavior in supply chain packages during execution
- • Deploy Egress Security & Policy Enforcement to block unauthorized outbound connections to cryptocurrency networks and suspicious domains used for C2 communications
- • Enable Multicloud Visibility & Control to detect anomalous traffic patterns and repeated malformed requests indicative of malware beaconing behavior
- • Establish Zero Trust Segmentation with least privilege access controls to limit blast radius when compromised packages execute in development and production environments
- • Implement Threat Detection & Anomaly Response capabilities to baseline normal application behavior and alert on deviations consistent with supply chain attacks
