--- title: Malicious npm packages evade install-script defenses at... description: An ongoing npm supply chain campaign centered on the 'indexed-btree' package, which impersonates the legitimate 'sorted-btree' library and has racked up 2... canonical: https://daily.dev/posts/malicious-npm-packages-evade-install-script-defenses-at-runtime-w4iq1yy8m twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Malicious npm packages evade install-script defenses at runtime | daily.dev og:description: An ongoing npm supply chain campaign centered on the 'indexed-btree' package, which impersonates the legitimate 'sorted-btree' library and has racked up 2... og:url: https://daily.dev/posts/malicious-npm-packages-evade-install-script-defenses-at-runtime-w4iq1yy8m og:image: https://api.daily.dev/og/posts/w4iQ1yY8M.png og:image:alt: Malicious npm packages evade install-script defenses at runtime og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Malicious npm packages evade install-script defenses at runtime **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 32 upvotes · 7 comments ## Summary An ongoing npm supply chain campaign centered on the 'indexed-btree' package, which impersonates the legitimate 'sorted-btree' library and has racked up 2 million weekly downloads, demonstrates how attackers can bypass GitHub's June 2026 npm security measures blocking install scripts. Instead of using preinstall/postinstall hooks, the malware hides its loader inside the BTree.prototype.set() method, a core function every user calls, so installation appears clean and evades taint-analysis and static scanners. Once triggered, it collects system details and exfiltrates them via Slack and Telegram, and polls an Ethereum Sepolia smart contract for C2 instructions using X25519 key exchange and AES decryption to fetch a second-stage payload. Checkmarx identified nine additional related packages, also removed from npm, with combined downloads in the millions. Affected developers are urged to rotate secrets and restore environments from safe backups. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the indexed-btree npm malware bypass npm's install-script security protections? It avoids preinstall, install, and postinstall lifecycle scripts entirely, instead hiding its malware loader inside the BTree.prototype.set() method of the package, a function that runs constantly during normal use. Because no install script executes, npm v12's approval mechanisms and most static taint-analysis scanners never flag the package as suspicious. _Track emerging supply chain attack techniques like this on daily.dev before they hit your dependencies._ ### What does the indexed-btree npm malware do once it executes? It collects system details including architecture, hostname, CPU, memory, and uptime, then exfiltrates that data through hardcoded Slack and Telegram channels. It also polls an Ethereum Sepolia testnet smart contract for command-and-control instructions, using X25519 key exchange to derive an AES key that decrypts a second-stage payload stored in the contract. _Developers auditing dependency risk can follow npm malware writeups like this on daily.dev._ ### Which npm packages were found to be part of the indexed-btree malware campaign? Checkmarx identified indexed-btree plus nine related packages: ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, and sliding-score-window. Combined, these packages accumulated millions of downloads, with btree-core alone reaching nearly 2 million, and all have since been removed from npm. _Anyone auditing their node_modules for compromised packages can check ongoing coverage on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@thatdeveloperguy** · 13 upvotes > @claude. npm install no virus no mistakes pls **@qwertydiy** · 12 upvotes > Here we go again. Move to pnpm everyone. **@hzmalix** · 9 upvotes >  **@jerusalemtame** · 3 upvotes >  **@user45613** · 2 upvotes > deno has built-in security measures [https://deno.com/#security](https://deno.com/#security) > > "Deno blocks file system, network, and environment access by default." --- Tags: [#cyber](https://daily.dev/tags/cyber), [#javascript](https://daily.dev/tags/javascript), [#github](https://daily.dev/tags/github), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/malicious-npm-packages-evade-install-script-defenses-at-runtime-w4iq1yy8m) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious npm packages evade install-script defenses at runtime","url":"https://daily.dev/posts/malicious-npm-packages-evade-install-script-defenses-at-runtime-w4iq1yy8m","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/malicious-npm-packages-evade-install-script-defenses-at-runtime-w4iq1yy8m"},"datePublished":"2026-09-20T14:13:20.663Z","dateModified":"2026-09-21T14:29:00.178Z","description":"An ongoing npm supply chain campaign centered on the 'indexed-btree' package, which impersonates the legitimate 'sorted-btree' library and has racked up 2...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/68fa8da1d70bc2c6f18ddf70faf5c239?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/68fa8da1d70bc2c6f18ddf70faf5c239?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":7,"discussionUrl":"https://daily.dev/posts/malicious-npm-packages-evade-install-script-defenses-at-runtime-w4iq1yy8m","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":32},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":7}],"keywords":"cyber,javascript,github,malware,npm","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Malicious npm packages evade install-script defenses at runtime"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/malicious-npm-packages-evade-install-script-defenses-at-runtime-w4iq1yy8m","comment":[{"@type":"Comment","text":"@claude. npm install no virus no mistakes pls","datePublished":"2026-09-20T21:18:58.472Z","url":"https://daily.dev/posts/w4iQ1yY8M#c-dzBunylxL","author":{"@type":"Person","name":"Nigel","url":"https://daily.dev/thatdeveloperguy","image":"https://lh3.googleusercontent.com/a/ACg8ocK9NWA-YOqxzVkAyu8zjUcC4TT5IUWb4mOYl6UdDlRvgaa8Ug=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":13}},{"@type":"Comment","text":"Here we go again. Move to pnpm everyone.","datePublished":"2026-09-20T20:01:28.099Z","url":"https://daily.dev/posts/w4iQ1yY8M#c-1d0Vk95RI","author":{"@type":"Person","name":"Rene Yibowei","url":"https://daily.dev/qwertydiy","image":"https://media.daily.dev/image/upload/s--QlvtioAW--/f_auto/v1746524446/avatars/avatar_aTUl3chxFyPngKtboGisL"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":12}},{"@type":"Comment","text":"","datePublished":"2026-09-21T05:18:45.021Z","url":"https://daily.dev/posts/w4iQ1yY8M#c-MOirJtkxg","author":{"@type":"Person","name":"Muhammad Hammad Zafar","url":"https://daily.dev/hzmalix","image":"https://avatars.githubusercontent.com/u/48489738?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":9}},{"@type":"Comment","text":"","datePublished":"2026-09-21T08:51:55.345Z","url":"https://daily.dev/posts/w4iQ1yY8M#c-4p7JAUbTH","author":{"@type":"Person","name":"Jerusalem Tame","url":"https://daily.dev/jerusalemtame","image":"https://lh3.googleusercontent.com/a/ACg8ocKDudMkGZxpgqJNjLFHFHDs922PU7E7wN_LVV8Jzw2KAYWxiI8=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3}},{"@type":"Comment","text":"deno has built-in security measures https://deno.com/#security\n“Deno blocks file system, network, and environment access by default.”","datePublished":"2026-09-21T13:19:32.953Z","url":"https://daily.dev/posts/w4iQ1yY8M#c-GW9rD9eZO","author":{"@type":"Person","name":"Veselin Ivanov","url":"https://daily.dev/user45613","image":"https://media.daily.dev/image/upload/s--nc0o8dM8--/f_auto/v1782457323/avatars/avatar_JYf2mTyl8QY4B2HJp3soD?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/malicious-npm-packages-evade-install-script-defenses-at-runtime-w4iq1yy8m#faq","mainEntity":[{"@type":"Question","name":"How does the indexed-btree npm malware bypass npm's install-script security protections?","acceptedAnswer":{"@type":"Answer","text":"It avoids preinstall, install, and postinstall lifecycle scripts entirely, instead hiding its malware loader inside the BTree.prototype.set() method of the package, a function that runs constantly during normal use. Because no install script executes, npm v12's approval mechanisms and most static taint-analysis scanners never flag the package as suspicious. Track emerging supply chain attack techniques like this on daily.dev before they hit your dependencies."}},{"@type":"Question","name":"What does the indexed-btree npm malware do once it executes?","acceptedAnswer":{"@type":"Answer","text":"It collects system details including architecture, hostname, CPU, memory, and uptime, then exfiltrates that data through hardcoded Slack and Telegram channels. It also polls an Ethereum Sepolia testnet smart contract for command-and-control instructions, using X25519 key exchange to derive an AES key that decrypts a second-stage payload stored in the contract. Developers auditing dependency risk can follow npm malware writeups like this on daily.dev."}},{"@type":"Question","name":"Which npm packages were found to be part of the indexed-btree malware campaign?","acceptedAnswer":{"@type":"Answer","text":"Checkmarx identified indexed-btree plus nine related packages: ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, and sliding-score-window. Combined, these packages accumulated millions of downloads, with btree-core alone reaching nearly 2 million, and all have since been removed from npm. Anyone auditing their node_modules for compromised packages can check ongoing coverage on daily.dev."}}]} ```