A malicious npm package called indexed-btree has been quietly stealing secrets from developer environments while completely sidesteping the supply chain controls GitHub introduced for npm in June 2026. Researchers at Checkmarx found that the package, which impersonates the legitimate sorted-btree library, had accumulated over 2 million weekly downloads before being taken down.
The technique that made it so effective: instead of placing malicious code in an installation script — the exact vector that npm v12’s new lifecycle-script controls are designed to block — the attackers hid their malware loader inside the library’s own BTree.prototype.set() method, the core function that every developer using the library calls constantly in normal operation. When the method receives a specific trigger key at runtime, it launches an obfuscated first stage that collects system details (hostname, CPU, memory, architecture, uptime) and exfiltrates them through hardcoded Slack and Telegram channels. A second stage payload is fetched from an Ethereum smart contract on the Sepolia test network, decrypted via X25519 key exchange, and executed. When the operators decide to end an attack, the malware can delete its files and remove its trigger from the package code, leaving few traces behind. Checkmarx also found nine additional packages linked to the same campaign, all now removed from npm, which collectively racked up millions more downloads.
How to check if you’re affected
Affected products include the following npm packages — check your package.json and lock files for any of these:
indexed-btreeordered-kv-indexbtree-leaderboardpriority-slot-queuebtree-range-storebtree-corebtree-time-indexbtree-lru-cacheneighbor-key-mapsliding-score-window
If any of these appear in your dependency tree, rotate all credentials, API keys, and secrets that were accessible from that development environment, and restore the environment from a clean backup.