Malicious npm Packages Evade Install Defenses at Runtime

Executive Summary

Software supply chain adversaries have evolved past traditional package installation defenses in an aggressive new malware campaign uncovered across the npm registry. As first detailed by BleepingComputer and security researchers, malicious packages—exemplified by the rogue library `indexed-btree`—are evading automated build scanners, package auditing tools, and installation flags (such as --ignore-scripts) by completely abandoning preinstall and postinstall lifecycle hooks. Instead, the malware lies dormant during the entire installation and CI/CD testing phase, executing malicious routines only when specific application business logic functions are invoked at runtime.

The indexed-btree package was designed to masquerade as the widely trusted `sorted-btree` library, a staple data-structure package commanding nearly two million weekly downloads across the JavaScript ecosystem. When a developer or dependent application incorporates the package and executes a standard data manipulation method—specifically BTree.prototype.set()—the Trojanized routine triggers an in-memory execution pipeline.

Once activated, the malware harvests host system metadata, cloud API keys, and developer environment variables, exfiltrating the data via encrypted Slack webhooks and Telegram bot channels. To ensure maximum resilience against takedowns and perimeter blocklists, the loader resolves its secondary command-and-control (C2) configuration directly from an Ethereum Sepolia smart contract on the blockchain, subsequently downloading and executing an in-memory stage-two payload. This campaign signals that install-time controls and static dependency checks are no longer sufficient to secure modern Node.js application pipelines.

Technical Vulnerability Analysis & Attack Chain

The attack demonstrates a calculated shift from loud installation-time hooks to stealthy, trigger-based runtime execution:

[Developer Adds Malicious Dependency (e.g. 'indexed-btree')]

│

▼

[Installation Phase (CI/CD / Developer Endpoint)]

- package.json Has NO preinstall, install, or postinstall Scripts

- Bypasses 'npm install --ignore-scripts' Restrictions

- Evades Static Dependency Audits & Install-Time Sandboxes

│

▼

[Application Runtime Execution Phase]

- Application Calls Standard Method: BTree.prototype.set(key, value)

- Trojanized Hook Intercepts Legitimate Data Insertion Logic

│

▼

[System Fingerprinting & Secret Harvesting]

- Collects Hostname, OS Kernel, User Telemetry, and Network Interfaces

- Plunders Environment Variables (.env, AWS_ACCESS_KEY_ID, GITHUB_TOKEN)

- Exfiltrates Reconnaissance via Slack Webhooks & Telegram Bot APIs

│

▼

[Decentralized Web3 C2 Resolution (Ethereum Sepolia)]

- Queries Blockchain Smart Contract to Extract Dynamic Payload URL

- Immune to Traditional DNS Sinkholing & Domain Takedowns

│

▼

[Stage-Two Payload Execution]

- In-Memory Download & Execution of Arbitrary Backdoor / Shellcode

- Establishes Persistent Foothold in Production Container Environments

1. The Obsolescence of Install-Script Controls

Following widespread supply chain attacks in recent years, the open-source community adopted standard defensive postures:

• Lifecycle Script Stripping: Developers routinely execute npm install --ignore-scripts within CI/CD pipelines to block arbitrary commands during installation.
• Registry Guardrails: In June 2026, npm introduced enhanced scanning algorithms specifically tailored to flag packages invoking shell commands in preinstall or postinstall hooks.

The operators of indexed-btree circumvented these controls by creating a valid, compliant package.json without any lifecycle script declarations. To all automated scanners and package managers, the artifact appears to be an innocent, pure-JavaScript data structure utility.

2. Runtime Hooking via BTree.prototype.set()

Rather than running on installation, the malicious code is embedded inside the library's primary computational logic. When the application initializes the B-Tree and calls:

tree.set(key, value);

The modified method executes the legitimate balancing algorithm while asynchronously launching a detached execution branch:

• Environment Ingestion: It inspects process.env for credentials matching high-value patterns: AWS_*, AZURE_*, GITHUB_TOKEN, NPM_TOKEN, PRIVATE_KEY, and DATABASE_URL.
• Exfiltration Beaconing: It serializes the gathered environment data into base64-encoded strings, dispatching them to attacker-controlled Slack webhook endpoints and Telegram Bot channels over outbound HTTPS (port 443).

3. Decentralized Web3 Command-and-Control (Sepolia Testnet)

To resolve the address of its second-stage payload without exposing static C2 domains that could be flagged by threat intelligence feeds, the malware queries an Ethereum smart contract deployed on the Sepolia testnet:

• Smart Contract Payload Pointers: The smart contract stores an encrypted hex string pointing to the active staging URL hosting the stage-two payload.
• Takedown Immunity: Because blockchain data is immutable and decentralized, SOC analysts and law enforcement cannot take down or seize the C2 beaconing infrastructure using traditional registrar abuse requests or DNS sinkholing.
• Payload Staging: Once the URL is decoded, the loader fetches and executes a compiled binary or node backdoor in memory, establishing a persistent reverse shell on the infected production host or developer workstation.

Threat Actor Profile & Campaign Attribution

• Campaign Evolution: Identified across multiple package iterations by research teams at Datadog, Socket, and Phylum. The threat actor demonstrates sophisticated software engineering knowledge, understanding how to camouflage malicious logic inside complex algorithmic code (B-tree self-balancing logic).
• Targeting Strategy: By typosquatting and brand-impersonating sorted-btree (a high-traffic package downloaded millions of times per month by fintech, analytics, and database applications), the adversary maximized the probability of landing inside enterprise server backends and production data pipelines.
• Infrastructure Overlap: The reliance on Web3 smart contract resolution combined with Slack/Telegram exfiltration mirrors tactics previously observed in cryptocurrency theft rings and automated CI/CD token harvester campaigns.

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance

• Immediate Dependency Removal:
  • Audit all package lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) across all repositories for references to indexed-btree.
  • Immediately purge and remove the package:

npm uninstall indexed-btree

npm install sorted-btree

• Mandatory Credential Rotation:
  • If indexed-btree was deployed in any environment, treat all environment variables as compromised. Immediately rotate all AWS IAM keys, GitHub personal access tokens, database passwords, and internal API keys accessible to the workload.

2. Network & Perimeter Defenses

• Restrict Production Outbound Egress:
  • Production Node.js microservices rarely require direct internet access to Slack or Telegram APIs. Enforce egress network security rules blocking outbound traffic to api.telegram.org and hooks.slack.com from production subnets.
• Snort / Suricata Rule: Detecting Web3 RPC & Suspicious Package Exfiltration:

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Node.js Malicious Package Telegram Beaconing"; flow:to_server,established; content:"POST"; http_method; content:"/bot"; http_uri; content:"sendMessage"; http_uri; classtype:trojan-activity; sid:20260922; rev:1;)

3. Endpoint Detection & Hunting Query

Sigma Rule: Node.js Process Spawning Interactive Shell or Network Utility

title: Node.js Process Spawning Unexpected Subprocess

status: experimental

description: Detects Node.js runtime executing shell or network utilities, indicating runtime exploitation of a trojanized dependency.

logsource:

category: process_creation

product: linux

detection:

selection_parent:

ParentImage|endswith:

- '/node'

- '/nodejs'

selection_child:

Image|endswith:

- '/bin/sh'

- '/bin/bash'

- '/usr/bin/curl'

- '/usr/bin/wget'

- '/usr/bin/python3'

condition: selection_parent and selection_child

level: high

tags:

- attack.execution

- attack.t1059.004

- attack.initial_access

- attack.t1195.001

Splunk Hunting Query: Outbound Connections to Web3 Testnet RPCs from App Clusters

index=network sourcetype=firewall_traffic src_zone="production-apps"

| where dest_port=443 AND (dest_ip IN ("sepolia.infura.io", "rpc.sepolia.org", "ethereum-sepolia.publicnode.com") OR match(dest_host, "(sepolia|infura|alchemy)\.io$"))

| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_host, dest_ip, app

| convert ctime(first_seen) ctime(last_seen)

| sort - count