A malicious npm package called indexed-btree has been caught hiding its payload inside application code, rather than using lifecycle scripts, which is a sign that threat actors are shifting tactics as security controls get tighter.

Checkmarx found the package, and they say it mimics a legitimate library called sorted-btree, which is an ordinary B-tree indexing utility, but unlike the usual supply chain attacks, this one does not rely on preinstall or postinstall hooks at all, instead, it runs entirely from application code at runtime.

The package and its GitHub repository are no longer available on npm, but the numbers are still striking, because it was first uploaded on June 18, 2026, by an npm user named charlessadler25, and it racked up millions of downloads in a short time, and worse, the campaign may have earned the attacker around €230,933.57 in cryptocurrency, which is about 109 ETH.

This matters because npm version 12 introduced a security change to block automatic execution of lifecycle scripts, which have been one of the most common ways malware gets run through packages, and as Checkmarx notes, these scripts are legitimate for compiling code, seeding data, or setting up configurations, but threat actors often abuse them to run malicious code without user consent during installation.

So the latest findings show that bad actors are adapting, by moving away from install hooks and putting the malicious code directly inside the library itself.

Quick Summary

How the Malware Works

The loader is hidden inside a method called BTree.prototype.set(), which then triggers a file called sharedLoad.min.js, and that JavaScript payload embeds the obfuscated first stage of the malware.

From there, the malware fingerprints the host, beacons the details to a hard-coded Slack channel and Telegram bot, and then uses the EtherHiding technique to pull next-stage encrypted blobs from a smart contract deployed on the Sepolia testnet, and finally merges them to form the second-stage payload.

The last step is cleanup, where it deletes the malicious artifacts and removes the trigger from the package code, so it can cover its tracks.

This is a notable shift because it means defenders cannot just block lifecycle scripts and call it a day, since the malicious code is now part of the library logic that runs when the application calls it.

The Profit and the Scale

The package was uploaded on June 18, 2026, and it amassed millions of downloads quickly, which suggests it was either widely used or widely installed through dependency confusion or typosquatting, though the exact mechanism is not fully detailed.

The attacker earned around 109 ETH, which at the time was worth about €230,933.57, so this was a profitable operation, and it shows that even with npm 12 blocking install hooks, attackers can still find ways to monetize.

Checkmarx says indexed-btree is one of many npm packages tied to the same operation, and all of them have since been removed from npm, and the list includes ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, sliding-score-window, and mutex-forge.

So this was not a one-off, it was a coordinated campaign with multiple packages, all mimicking legitimate utilities to blend in.

PolinRider Resurfaces on Packagist

The disclosure comes as Socket says it deleted malicious code in the dev-main version of visanduma/nova-two-factor, a Packagist package with over 700,000 cumulative downloads, as part of an ongoing North Korea-linked campaign called PolinRider.

A defining trait of PolinRider is that the threat actor compromises developer accounts to inject malicious content into source code repositories, and then uses routine developer actions, like cloning a repository or opening it in an IDE, as triggers to activate the infection chain.

This often involves rewriting Git history, concealing payloads in configuration or font files, setting up malicious VS Code auto-run tasks, and relying on takedown-resistant techniques like EtherHiding and its successor NullReceiver for staged payload delivery via the blockchain.

Socket researcher Karlo Zanki says analysis of the Visanduma GitHub organization indicates its repositories have been compromised since mid-June 2026, and the malicious changes were introduced through the LaHiRu developer account.

A major difference seen in the most recent version is the injection of highly obfuscated JavaScript code in index.php and then running it via PHP shell_exec() function, indicating that the threat actors are adapting their execution methods based on the compromised project instead of using a fixed delivery path.

Socket notes that this activity reinforces a defining characteristic of PolinRider, where package-registry compromise is often a consequence of a broader Git-based intrusion rather than the campaign's primary objective, and the operators use ordinary source-code collaboration to reach developer environments, spread into additional repositories, and maintain access over time.

What Defenders Should Do

Checkmarx recommends that developers should not stick only to install-time scanning and blocking lifecycle scripts, but should also employ runtime behavior analysis.

Ensar Seker, CISO at SOCRadar, said in a statement shared with The Hacker News that what makes this campaign particularly important is that it shows attackers adapting almost immediately to stronger software supply chain defenses, and npm has improved install time security by restricting dependency lifecycle scripts, but this campaign demonstrates that attackers can simply move malicious execution into legitimate-looking runtime functionality instead.

Seker also said the broader lesson is that security controls change attacker behavior rather than eliminate the underlying threat, and blocking lifecycle scripts is an important improvement, but attackers will continue searching for alternative execution paths, so defenders need layered controls capable of detecting malicious behavior before installation, during execution, and after deployment.

For practical steps, developers should review dependencies for runtime anomalies, monitor for unexpected network calls to Slack, Telegram, or blockchain endpoints, and treat any package that suddenly gains millions of downloads as suspicious, and they should also check for the specific package names listed above and remove them if found.

The Bottom Line

The indexed-btree malicious npm package shows that attackers are adapting to npm 12's lifecycle script restrictions by moving their payload into runtime code, and they earned around 109 ETH in the process, while the related PolinRider campaign on Packagist shows a similar pattern of compromising developer accounts and using normal development workflows to spread, so defenders need layered detection, not just install-time blocking.

Quick Reference

What to Do

• Remove indexed-btree and related packages if present
• Monitor for runtime network calls to Slack, Telegram, or blockchain
• Use runtime behavior analysis, not just install-time scanning
• Review dependencies for unexpected code execution
• Treat sudden download spikes as suspicious

FAQ Section

What is the indexed-btree package?

This package is malicious and works just like a legitimate B-tree utility. It only differs in that, instead of using lifecycle scripts, it hides its payload in runtime code, so it runs when the application calls a specific method.

How does it avoid detection?

It does not use preinstall or postinstall hooks, so npm 12's lifecycle script blocking does not stop it, and it hides the loader inside BTree.prototype.set(), then fetches further stages via EtherHiding on the Sepolia testnet.

How much did the attacker earn?

Around 109 ETH, which was about €230,933.57 at the time, and the package was downloaded millions of times before it was removed.

What other packages are part of this campaign?

Checkmarx lists ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, sliding-score-window, and mutex-forge, and all have been removed from npm.

What is PolinRider?

It is a North Korea-linked campaign that compromises developer accounts to inject malicious code into repositories, and it uses developer actions like cloning or opening a project in an IDE to trigger the infection, and it has recently resurfaced on Packagist.

What should developers do?

They should use runtime behavior analysis in addition to install-time scanning, monitor for unexpected network calls, and remove any of the listed packages if present.

Source: The Hacker News