indexed-btree: npm Supply Chain Malware Executes at Runtime and Uses a Smart Contract on Ethereum Sepolia for C2

1. Basic Information

• Original Title: npm 'btree' Malware Campaign Affects Millions of Downloads, No Need for Install Script
• Source: Checkmarx Zero
• Publication Date: 2026-09-17
• Update Date: None
• Severity: High
• Severity Justification: The malicious npm packages do not use install scripts and instead launch a loader from within a normal library method. Checkmarx states indexed-btree reached nearly 2 million weekly downloads, and confirms capabilities to exfiltrate host information, resolve C2 destinations via smart contracts on Ethereum Sepolia, and decrypt an encrypted second-stage payload. The number of hosts executing the malware in real environments and the contents of the second stage have not been publicly disclosed.
• Original Article: npm 'btree' Malware Campaign Affects Millions of Downloads, No Need for Install Script
• Related Source: BleepingComputer: Malicious npm packages evade install-script defenses at runtime
• Related Entities: indexed-btree, sorted-btree, npm, Node.js, Ethereum Sepolia, Slack, Telegram

2. Executive Summary

Attackers embedded malicious code in indexed-btree, a package designed to resemble the legitimate sorted-btree. Rather than running during installation, the loader is triggered when BTree.prototype.set() is called with key == 100. Once launched, it sends host information to Slack and Telegram and retrieves a C2 destination and encrypted blobs that are combined into a second-stage payload from a smart contract on Ethereum Sepolia.

3. Attack Flow

The following behavior was confirmed by Checkmarx through package analysis. The number of package downloads does not equal the number of systems where the malicious logic actually executed in user environments.

Stage 1: Disguise as Legitimate Package and Introduction

1. Attackers published indexed-btree to npm, using a name similar to the B-tree / indexing library sorted-btree.
2. They prepared a legitimate-looking GitHub repository, commit history, and developer account. According to Checkmarx, the GitHub repository did not contain the malicious code found in the npm package.
3. The package defines no preinstall, install, or postinstall hooks, so installation alone does not execute the malicious logic. This can evade controls that inspect only lifecycle scripts.

Stage 2: Loader Execution from Normal Method

1. The malicious logic is embedded in BTree.prototype.set(key, value, overwrite).
2. When extended/sharedLoad.min.js exists and key == 100, the code uses Node.js child_process.spawn() to launch the file in a detached node child process.
3. sharedLoad.min.js uses obfuscation techniques including string-array encoding and self-checksumming array rotation.

Stage 3: Information Exfiltration and Second-Stage Retrieval

1. The loader collects OS architecture, hostname, CPU, memory, and uptime, then sends them to hardcoded Slack channels and Telegram chats.
2. It polls a smart contract on Ethereum Sepolia to obtain the C2 destination. Even if domains or IPs are blocked, the connection target can be switched by updating the value on the smart contract side.
3. The loader generates an X25519 key pair and retrieves the attacker's public key from the smart contract. It derives an AES key from the ECDH shared secret, then decrypts and combines two ciphertexts within the smart contract to construct the second-stage payload.
4. The loader also contains cleanup functionality that can delete malicious files and remove the trigger from the prototype method.

4. Attacker Location and Execution Environment

• Attackers use the npm registry and the deceptive GitHub repository as distribution vectors.
• Initial malicious execution occurs on developer terminals, CI runners, build environments, or Node.js applications that incorporate indexed-btree.
• Slack, Telegram, and Ethereum Sepolia RPC endpoints are used to exfiltrate host information, retrieve C2 destinations, and pass decryption materials for the second stage.

5. Visibility for Victims and Administrators

• Victims: Package installation completes normally with no explicit installation script warnings. Malicious processing begins only after the application calls BTree.prototype.set() under the matching condition.
• Administrators: Dependencies will list indexed-btree or related packages. During execution, traces include detached child processes spawned by Node.js using extended/sharedLoad.min.js as an argument, along with network traffic to Slack/Telegram APIs and Ethereum Sepolia RPC.

6. Success and Failure Conditions

Success Conditions

• The malicious package is introduced as a dependency and loaded in a real Node.js environment.
• extended/sharedLoad.min.js exists and BTree.prototype.set() receives a call where key == 100.
• The execution host can make outbound connections to Slack, Telegram, Ethereum Sepolia RPC, and the subsequent C2 specified by the smart contract.

Failure Conditions

• Pinning approved packages and versions, validating lockfiles, registry metadata, and fetched tarball digests to reject malicious dependencies before installation.
• Moving beyond the presence of install scripts to analyze and monitor normal package execution paths and child process generation.
• Restricting outbound communication from developer endpoints, CI runners, and production Node.js workloads to required registries and services, blocking unnecessary traffic to Slack, Telegram, and public blockchain RPCs.

7. Impact on Success

• Host architecture, hostname, CPU, memory, and uptime are transmitted to the attacker's Slack/Telegram destinations.
• The loader can decrypt and execute the encrypted second-stage payload using information retrieved from the smart contract on Ethereum Sepolia.
• Depending on the contents of the second stage, impact could expand to developer workstations, CI/CD credentials, source code, and deployment secrets. However, public information does not indicate the specific functionality of the second stage or actual damage.
• When the cleanup function executes, malicious files and triggers are deleted, reducing forensic traces during post-incident investigation.

8. Observable Logs

• Email: No email-based delivery vector has been reported.
• Proxy / SWG / DNS: Check for connections to Slack API, Telegram API, Sepolia RPC providers, and destinations returned by smart contracts. Without HTTPS decryption or URL logging, the specific contents of smart contract calls cannot be verified.
• Endpoint / EDR: Identify detached child processes from the Node.js application equivalent to node extended/sharedLoad.min.js 100, obfuscated JavaScript under the package directory, and the deletion of malicious files or triggers.
• Identity / IdP: The report does not detail abuse of IdP authentication. If secrets on the execution host may have been accessed, review access logs for related service accounts, CI/CD tokens, and cloud credentials.
• SaaS / Cloud: Check npm proxy/artifact repository download history, lockfiles, SBOMs, CI job logs, bot communications to Slack/Telegram, and access history for cloud secrets.
• Network: Correlate unusual outbound connections from Node.js workloads to Slack, Telegram, and Ethereum Sepolia RPC, followed by connections to newly observed destinations.

9. Assessment of Attack Success

Confirmed in Public Information

• Malicious Package Distribution and Features Confirmed (Execution and Impact Unconfirmed): Checkmarx analyzed the conditional logic within BTree.prototype.set(), the launch logic for sharedLoad.min.js, and the capability to send host information to Slack/Telegram. Execution in specific user environments, actual data exfiltration, credential theft, and follow-on impact from the second stage have not been publicly confirmed.

Internal Assessment Criteria

• Initial Execution Confirmed: Correlate the Node.js parent process, sharedLoad.min.js child process, package access at the relevant time, and outbound network traffic on the same host.
• Malware Execution or Authentication Success Confirmed: Confirm queries to the Sepolia smart contract, ciphertext retrieval, and subsequent code or process execution after decryption.
• Data Exfiltration or Session Compromise Confirmed: Correlate host information transmission to Slack/Telegram, or the reading and unauthorized use of CI/CD, cloud, or repository credentials.

10. Investigation Playbook

• Trigger: Initiate based on the detection of indexed-btree or related packages, Sepolia RPC communication from Node.js, or the execution of sharedLoad.min.js.
• Initial Verification: Identify package names, versions, digests, lockfiles, SBOMs, npm proxy logs, installation timestamps, execution hosts, and jobs.
• Endpoint: Preserve package tarballs and extracted contents, extended/sharedLoad.min.js, Node.js process lineage, memory/disk artifacts, and deletion traces.
• Identity and Cloud: Enumerate secrets, service accounts, repository tokens, and cloud credentials accessible by the target host and CI jobs, and review usage history after package installation.
• Subsequent Activity: Chronologically track Slack/Telegram transmissions, Sepolia smart contract calls, C2 destinations indicated by smart contracts, and second-stage retrieval, decryption, and execution.
• Containment: Remove malicious packages from dependencies and caches, isolate affected hosts/runners, and rebuild from trusted images. Revoke and reissue any potentially exposed secrets.
• Classification: Differentiate between package acquisition, runtime triggers, loader execution, host information exfiltration, second-stage retrieval, and credential theft/abuse.

11. Defense and Detection Ideas

• Single Events: Detect detached child process creation under Node.js packages, sharedLoad.min.js execution, and blockchain RPC or messaging API communications originating from Node.js.
• Timeline Correlation: Correlate package installation, initial application loading, child processes spawned after BTree.prototype.set() calls, Slack/Telegram, Sepolia, and subsequent C2 traffic in chronological order.
• Threat Hunting: Search lockfiles, SBOMs, artifact caches, CI workspaces, and production images for related package names, and check for differences between package code and public GitHub repositories.
• Log Gaps: npm download history alone cannot determine runtime triggers. Maintain process telemetry, outbound network traffic, and artifact provenance for CI runners and Node.js workloads.
• Priority Mitigations: Prioritize removing affected packages, rebuilding hosts/runners, rotating credentials, implementing allowlist-based dependency management, monitoring runtime child processes, and controlling outbound network traffic.

12. Facts / Inference / Hypothesis

Facts

• Checkmarx confirmed that indexed-btree lacks an install script and instead executes code launching extended/sharedLoad.min.js from the key == 100 condition inside BTree.prototype.set().
• Checkmarx confirmed functionality to send host information to Slack/Telegram and use smart contracts on Ethereum Sepolia as C2 reference points and encrypted payload storage.
• Checkmarx stated that indexed-btree reached approximately 2 million weekly downloads and reported that 9 packages related to the same campaign were removed from npm.
• Checkmarx confirmed a cleanup feature, but did not publicly disclose the number of executions in real environments, second-stage contents, or the scope of impact.

Inference

• Relying solely on the absence of installation hooks as an indicator of safety causes teams to overlook execution vectors embedded within normal library methods. This case demonstrates the need to combine package acquisition inspection with runtime process and network telemetry.
• Because the contents of GitHub repositories and distributed tarballs differ, the appearance or commit history of a source repository alone cannot determine the integrity of distribution artifacts.

Hypothesis

No additional hypotheses. Unconfirmed items are noted in 'Unknowns and Further Investigation'.

13. MITRE ATT&CK Mapping

• T1195.002 Compromise Software Supply Chain (Confidence: High): Attackers masquerade malicious npm packages as legitimate libraries to introduce them into development and execution environments.
• T1059.007 Command and Scripting Interpreter: JavaScript/JScript (Confidence: High): Executes obfuscated JavaScript loaders and the second stage using Node.js.
• T1102.001 Web Service: Dead Drop Resolver (Confidence: Medium): References smart contracts on Ethereum Sepolia to retrieve C2 connection targets and encrypted payloads.
• T1027 Obfuscated Files or Information (Confidence: High): sharedLoad.min.js uses obfuscation involving string array encoding and self-inspection.
• T1070.004 Indicator Removal: File Deletion (Confidence: Medium): Features a cleanup capability that deletes malicious files and the trigger from the prototype method.

14. Unknowns and Further Investigation

• The number of hosts, organizations, and geographic regions where indexed-btree and related packages were actually executed.
• Specific functionality, retrieved samples, and execution results of the second-stage payload.
• Whether secrets, source code, or artifacts other than host information were exfiltrated.
• The malicious versions, active publication periods, and removal/blocking status on npm for each package.
• The relationship between the 109 ETH wallet balance associated with the attacker by Checkmarx and revenue from this campaign. BleepingComputer noted that no funding source has been demonstrated.

15. Impact on SOCs and Organizations

npm v12's lifecycle-script restrictions are a useful layer of defense, but they do not prevent attackers from moving malicious logic into normal package functionality. Organizations that use Node.js in development, CI/CD, or production should correlate install-time controls with the provenance of distributed tarballs, runtime child-process activity, and outbound network traffic for the same dependency. Because CI runners often have access to numerous secrets, investigations should not stop at detecting package acquisition; they should separately determine whether the package executed and whether any secrets were accessed or abused.

16. Summary by Role

• SOC: Correlate related package acquisition, Node.js child processes, Slack/Telegram, Sepolia, and subsequent C2, distinguishing between runtime triggers and second-stage activation.
• Administrators: Remove related packages from lockfiles, SBOMs, and artifact caches, rebuild affected runners, and revoke/reissue any secrets that were reachable.
• Users: If affected packages may have been used in development environments, contact the security or development team and follow investigation procedures rather than deleting packages independently.