Malicious npm Package With 2 Million Downloads Hides Malware in Runtime Code

A malicious npm package that appeared to be an ordinary data-indexing tool has exposed a weakness in software supply-chain defenses.

The package, indexed-btree, copied the identity of the legitimate sorted-btree library and recorded almost two million weekly downloads. The campaign is notable because the malware does not need to run while a developer installs it.

Instead, it waits inside normal application code and activates when the library is used, turning a trusted dependency into a route for host profiling, data theft, and follow-on payload delivery. Researchers at Checkmarx identified the activity.

Checkmarx said in a report shared with Cyber Security News (CSN) that the operation shows why checks focused only on install scripts can miss threats that execute later.

The scale creates risk for organizations whose projects may have pulled the package into build systems, test environments, or production services.

Attackers also created a convincing repository and account history, adding credibility to a package designed to blend into routine development work.

Malicious npm Package With 2 Million Downloads

Indexed-btree has no preinstall or postinstall command in its package configuration, so installing it alone does not trigger the malicious routine. That absence can make a package look safe during a quick review.

The loader is placed in BTree.prototype.set, a core method likely to be called as an application stores data. When the required condition is met, that code starts an obfuscated first-stage component, allowing the threat to run during normal program activity rather than at the more closely watched installation stage.

This design changes the defensive question from whether a package has a risky installer to what it does after import and use. Earlier reports on malicious package mirror abuse show attackers continue to adapt trusted developer channels for delivery.

The first stage gathers the operating-system architecture, host name, processor, memory, and system uptime. It sends this information to attacker-controlled destinations, then consults a smart contract on the Ethereum Sepolia test network instead of a conventional command server.

That blockchain-based design can make disruption harder because the contract can point malware to a replacement address if an earlier destination is blocked.

The code then uses a cryptographic key exchange to derive a decryption key and combine encrypted data from the contract into a second-stage payload, according to the research.

The package also includes functions intended to remove malware files and erase the trigger from the prototype method. The cleanup could limit evidence after the application first uses the library.

Supply-Chain Defenses Need Runtime Checks

The campaign illustrates a gap when security teams treat the absence of lifecycle scripts as proof that an npm package is harmless. That control does not examine malicious behavior embedded directly in a package’s main JavaScript functions.

Organizations should identify whether affected package names or versions are present in source trees, lockfiles, build images, developer workstations, and continuous-integration systems.

Teams should remove them, rotate potentially exposed secrets, and inspect logs for the indicators listed below. Dependency review should include ownership, release history, repository consistency, and code distributed through the registry.

A recent npm package compromise report also shows how trusted dependencies can become a direct route into developer and CI environments.

For stronger coverage, teams should run suspicious packages in isolated environments and monitor child processes, filesystem changes, network calls, and behavior after common methods are invoked. This can reveal malicious runtime paths that static scans overlook.

Developers should pin reviewed dependency versions, keep software bills of materials current, and enforce approval for new or abruptly changed packages.

The broader pattern has included backdoored npm package waves and binding configuration abuse, reinforcing the need to watch installation and execution.

For responders, the priority is to determine whether the library was merely downloaded or actually used in a running process. Runtime evidence, process records, and network telemetry may provide the clearest answer while the campaign remains active.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Malicious npm Package With 2 Million Downloads Hides Malware in Runtime Code appeared first on Cyber Security News.