npm Package indexed-btree Evades Install-Time Defenses With Runtime Payload

On September 20, 2026, Checkmarx published its analysis of an npm campaign that exploits a previously undocumented evasion technique: the malicious payload is embedded in the BTree.prototype.set() method of a library impersonating the legitimate sorted-btree package, which commands nearly 2 million weekly downloads. Execution occurs at runtime when the application invokes the method, not during installation, rendering the mandatory approval mechanisms GitHub introduced in npm v12 in June 2026 to block preinstall, install, and postinstall scripts ineffective.

How the Evasion Works: From the set() Method to Ethereum C2

The technique breaks sharply from prior npm evasions. As documented by Checkmarx and reported by BleepingComputer, the malware does not rely on installation lifecycle hooks — preinstall, install, postinstall, or binding.gyp — but nests inside the library's core method itself. "The malware loader hides inside the library's own BTree.prototype.set method, which is the main function that every user would call constantly," Checkmarx researchers stated via BleepingComputer.

When the method is invoked with a specific key, the execution chain triggers. The first stage resides in sharedLoad.min.js, heavily obfuscated. Checkmarx researchers describe it as "a well-built way to sneak past standard taint-analysis tools and most static scanners." This means static scanners and taint-analysis tools typically used for npm dependency vetting do not detect the anomaly, because the code presents no suspicious patterns at install time.

After activation, the malware collects system information: architecture, hostname, CPU, available memory, and uptime. Exfiltration occurs through hardcoded Slack and Telegram channels embedded in the payload. Command and control, however, routes through an Ethereum smart contract on the Sepolia test network, using X25519 key exchange and AES decryption. The attacks do not exfiltrate sensitive data directly onto the blockchain; the contract serves as an orchestration mechanism, leveraging decentralization to complicate C2 takedown.

Why npm v12 Defenses Miss the Payload

In June 2026, GitHub introduced mandatory approval mechanisms for installation scripts in npm v12: any package executing code in the preinstall, install, or postinstall phases now requires explicit user or administrator confirmation. The indexed-btree campaign exposes the architectural limits of this approach. "As a result, installation appears clean and triggers none of npm v12's approval mechanisms," BleepingComputer summarizes from the Checkmarx analysis.

The distinction is clear: npm v12 governs the installation lifecycle, not application code execution. When an application imports a library and calls its methods, the Node.js runtime applies no sandbox or approvals. The attacker simply moved the trigger point from install time to use time, exploiting an intrinsic property of the ecosystem: libraries are meant to be executed.

OffSeq Radar confirms the nature of the evasion: "embedding malicious code in the package's runtime behavior instead of installation scripts." This formulation, convergent with the primary Checkmarx source, underscores that the technique does not exploit an npm v12 vulnerability but its design blindness toward post-installation behavior.

"This evasion technique undermines supply chain security measures that rely on detecting malicious install scripts" — OffSeq Radar

The Distribution Chain: Fake Repositories and Nine Satellite Packages

The operators built a GitHub repository with a curated commit history to appear legitimate. This element is not decorative: in an ecosystem where social proof — stars, forks, recent activity — influences adoption decisions, the repository's superficial credibility lowers developers' perceptual defenses.

Checkmarx discovered nine additional npm packages linked to the same operation. Those packages have been removed from the npm registry, but the source does not specify their names. It is not documented whether they share the same runtime technique or adopt variants. This gap prevents tracing the exact extent of the campaign beyond the primary package.

The attackers' Ethereum wallet held 109 ETH at the time of detection. The Checkmarx report does not state that these funds derive from cryptocurrency theft or ransoms: they could be provisioning funds for the C2, proceeds from collateral activity, or simply pre-existing capital. The source does not clarify the origin.

Why This Matters

The indexed-btree case is not an isolated anomaly: it is the third generation of documented npm evasions in 2026, following the ChainDrop campaign (preinstall worm, Microsoft and StepSecurity, August 2026) and Shai-Hulud (binding.gyp evasion, Morphisec). Each reacted to a specific hardening, shifting the attack to an adjacent vector. ChainDrop bypassed preinstall scrutiny with worm-like propagation; Shai-Hulud abused the native build process; indexed-btree abandons the installation lifecycle entirely.

The dossier does not document specific remedial measures released by npm or GitHub beyond package removal. The existence of a dedicated CVE for this campaign is not confirmed: CVE-2026-27960 in NVD sources concerns a privilege escalation in OpenCTI, not npm. The actual campaign start date is unknown. The exact trigger mechanism via key in the set() method is not specified, nor are published indicators of compromise for retrospective detection.

The most relevant limitation for software pipeline operators is that none of the current defenses — install-time scanners, script approval, static manifest analysis — would have detected this payload. The malicious code is not in package.json, not in a hook, not in a precompiled binary: it resides in the library's own method, indistinguishable from functional code until invoked with the activating key.

The npm ecosystem now faces a fundamental problem: every install-time barrier incentivizes attackers to hide deeper, where controls do not reach. Defenses must shift downstream, toward runtime behavioral analysis and network call monitoring in execution environments, but the brief does not document available tools or frameworks for this transition.

Sources

• https://www.bleepingcomputer.com/news/security/malicious-npm-packages-evade-install-script-defenses-at-runtime/
• https://radar.offseq.com/threat/malicious-npm-packages-evade-install-script-defenses-at-runtime-bd6632abcdaf0649
• https://nvd.nist.gov/vuln
• https://nvd.nist.gov/vuln/detail/cve-2026-27960
• https://www.stepsecurity.io/blog/chaindrop-npm-worm
• https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/
• https://www.morphisec.com/blog/its-in-your-ai-assistant-now-shai-hulud-wave-3-and-the-miasma-worm-targeting-npm/
• https://nvd.nist.gov/vuln/search
• https://nvd.nist.gov/vuln/weaknesses
• https://nvd.nist.gov/vuln/data-feeds

Information is based on the cited source and current as of publication.

Sources