10 Malicious npm Packages Linked to Runtime Malware Campaign With Millions of Downloads

A sophisticated npm supply-chain campaign has been linked to 10 malicious JavaScript packages that collectively recorded millions of downloads while bypassing npm’s lifecycle-script protections.

The operation centers on a counterfeit package named indexed-btree, which impersonates the legitimate sorted-btree library and executes its malware only when an application uses the package at runtime.

Unlike conventional npm malware campaigns that rely on preinstall, install, or postinstall hooks, the operators embedded the loader inside BTree.prototype.set(), a core library method likely to be invoked during normal application execution.

The package’s package.json contains no suspicious lifecycle hook, allowing installation to appear benign and avoiding protections introduced in npm v12 that require explicit approval for dependency scripts.

The runtime trigger checks for a specific condition an invocation of the set() function using key value 100 before launching an obfuscated loader, sharedLoad.min.js, in a detached Node.js process.

This execution path moves malicious activity away from the installation phase and into ordinary program behavior, reducing the effectiveness of install-time controls and static package reviews focused primarily on lifecycle scripts.

The attackers reinforced the package’s legitimacy by operating a GitHub repository with a populated commit history and a seemingly authentic developer profile, while keeping the malicious code out of the public repository.

The first-stage loader is heavily obfuscated using string-array encoding and self-defending code.

Once activated, it fingerprints the infected host, collecting details such as operating-system architecture, hostname, CPU information, memory, and uptime.

10 Malicious npm Packages

The data is then exfiltrated through hardcoded Slack and Telegram infrastructure.

Checkmarx said in a report shared with GBhackers, the package gained nearly 2 million weekly downloads, demonstrating the scale a deceptive runtime-focused package can reach.

More notably, the malware uses an Ethereum Sepolia testnet smart contract as a command-and-control mechanism.

Rather than directly contacting a conventional C2 domain or IP address, the implant polls the contract’s getter and setter functions for infrastructure updates and payload data.

This approach makes takedowns more difficult because operators can redirect victims to new infrastructure through on-chain updates instead of replacing a hardcoded domain inside the malware.

The loader also implements an X25519 elliptic-curve Diffie-Hellman key exchange. It generates a local X25519 key pair, retrieves the operator’s public key from the smart contract, derives a shared secret, and uses it to produce an AES key.

That key decrypts encrypted payload fragments stored on-chain, reconstructing the second-stage malware dynamically.

The malware additionally includes cleanup functionality designed to delete its files and remove the malicious prototype trigger, limiting forensic evidence after execution.

Checkmarx identified indexed-btree as the primary malicious package and linked nine additional packages to the same operation: ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, and sliding-score-window.

btree-core alone recorded 1,951,274 downloads, while the others each accumulated hundreds of thousands of downloads. The linked packages have since been removed from npm.

The researchers also connected the campaign’s smart-contract infrastructure to the previously identified mutex-forge package.

At the time of Checkmarx’s analysis, the threat actors appeared to control 109 ETH, valued at approximately €230,933.57; however, the research does not establish that the wallet’s entire balance was derived from this campaign.

The indexed-btree package has been classified as malicious by Snyk, which assigns it a critical 9.3 severity rating and advises organizations to avoid all instances of the package.

Organizations that installed any of the 10 packages should treat affected development and build environments as potentially compromised.

Teams should rotate credentials, API tokens, SSH keys, cloud secrets, npm tokens, and CI/CD variables accessible from those environments; rebuild systems from known-good sources.

Review outbound connections to the Ethereum Sepolia network, Slack, and Telegram; and audit dependency lockfiles and software bills of materials for the affected package names.

Runtime behavior monitoring is now essential: the absence of lifecycle scripts cannot be treated as evidence that an npm dependency is safe.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC