A malicious npm package with a weekly download count in the millions has been discovered hiding its payload not in the usual place, but somewhere far harder to catch: inside the code that runs every time a developer’s application actually uses the library. Researchers at Checkmarx identified the campaign, centered on a package called indexed-btree, which appears designed to piggyback on the reputation of a legitimate and widely trusted library, sorted-btree.

Skipping the Install-Script Trick

Most npm supply-chain attacks that make headlines rely on malicious install scripts — code that fires the moment npm install runs, before a developer has any chance to inspect what they’ve pulled in. Security tooling has increasingly caught up to that pattern, scanning packages for suspicious install hooks before they ever reach a project.

indexed-btree sidesteps that entirely. Instead of an install script, the malicious logic is embedded directly inside BTree.prototype.set, one of the library’s core, frequently-called methods. That means the malware doesn’t activate when the package is installed — it activates later, during ordinary runtime use, whenever an application actually calls the function a data-structure library like this one is built around. As Checkmarx researchers put it, “the malware does not need to run while a developer installs it,” which is precisely what let it evade the install-time scanning many teams now rely on.

What the Malware Actually Does

Once triggered, the package’s first-stage payload performs basic reconnaissance on the host system, collecting operating-system architecture, hostname, processor details, memory information, and system uptime. That fingerprint is then sent onward to attacker-controlled infrastructure, giving the operators a profile of every environment the package has managed to run inside — developer laptops, CI pipelines, and production servers alike.

Command-and-Control, Powered by a Blockchain

The most distinctive element of the campaign is how it finds its handlers. Rather than hardcoding a domain or IP address that defenders could simply block or take down, the malware queries a smart contract deployed on the Ethereum Sepolia test network, at address 0xE390863Dac96a7118C71227C2b099B50cF602D31. The contract effectively acts as a resilient, hard-to-seize pointer to wherever the attackers currently want infected systems to report.

This blockchain-based redirection technique has shown up in a handful of other supply-chain campaigns over the past couple of years, and it solves a real operational problem for attackers: domains and IPs get sinkholed or blacklisted, but a smart contract on a public blockchain is much harder for defenders or registrars to take offline. Because the command infrastructure can be updated by simply pointing the contract elsewhere, the campaign can survive takedown attempts that would kill a more conventional setup outright.

The Scale of the Exposure

With close to two million downloads a week, indexed-btree’s reach isn’t a niche concern — it’s the kind of number typically associated with foundational, widely depended-upon packages. Any project that pulled it in as a drop-in stand-in for sorted-btree, whether directly or as a transitive dependency several layers deep, has potentially been executing the runtime payload without any obvious sign of compromise.

What Development Teams Should Do

Organizations using either indexed-btree or sorted-btree should audit their dependency trees immediately to confirm which one is actually in use, treat any hosts that loaded the malicious package as potentially compromised, and rotate credentials or tokens accessible from those environments. More broadly, the case argues for runtime application monitoring alongside install-time scanning — a package that behaves innocently at install and only turns hostile once its functions are actually called will slip past tools that only ever look at the moment of installation. Pinning dependency versions, verifying package provenance, and watching for outbound connections to unfamiliar blockchain RPC endpoints are all reasonable additions to a supply-chain defense checklist going forward.