Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal
Malicious npm package 'indexed-btree' hid malware in runtime code, bypassing new security controls.
A malicious npm package named 'indexed-btree' mimicked a legitimate utility but hid its malware loader within application runtime code, bypassing recent npm security changes that restrict automatic execution of lifecycle scripts. The package, uploaded by 'charlessadler25', amassed millions of downloads before removal and potentially earned the attacker over €230,000 in cryptocurrency. This tactic shift highlights attackers adapting to new defenses by embedding malicious code directly into library functions.
AI summary of the linked source. Not reviewed by an editor. How this works
Run npm?
Get an email when a new story names npm, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe 'indexed-btree' npm package demonstrates a sophisticated supply chain attack where malicious code was embedded directly into library runtime functions rather than lifecycle scripts, deliberately circumventing npm's newer security controls. Millions of downloads occurred before the package was detected and removed, highlighting how slow or absent code inspection of third-party dependencies creates massive exposure windows. This tactic shift — from install-time execution to runtime execution — shows attackers actively adapting to platform-level defenses, making static policy controls insufficient on their own. The financial impact (€230,000+ in cryptocurrency) underscores that supply chain attacks are highly profitable, incentivizing continued investment by threat actors. Organizations that blindly trust package download counts or registry presence as proxies for legitimacy remain critically vulnerable.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — indexed-btree
- url — https://sepolia.etherscan.io/