New npm malware finds way to bypass installer script defenses

Simply rejecting suspicious installation scripts may no longer be enough to address the threat of malicious JavaScript dependencies used in software supply chain attacks. Security researchers at Checkmarx are warning of attackers using a malicious package called “indexed-btree” to mimic the legitimate sorted-btree library, spreading malware hidden in the package’s regular execution code.

See also: jscrambler npm: Malicious 8.14.0 installs Rust infostealer via npm install

The campaign abandons the preinstall and postinstall scripts common in recent attacks, instead using a basic package function to deliver its malicious payload. Checkmarx reported that the malicious package was downloaded nearly 2 million times a week before being flagged and removed from the registry on September 3, 2026.

This happened about 11 weeks after the malicious version was first released, according to independent analysis by Blogspan author Alexander Baumgärtner . The discovery comes after npm introduced stricter controls around lifecycle scripts in June.

Combining Blockchain C2 with Slack/Telegram data theft

The malicious script was embedded directly into a “ BTree.prototype.set ” execution method , rather than an installation hook in the package’s package.json . When the method receives a specific key value, the code launches a disguised first-stage loader as a detached Node.js process. Once launched, the loader collects system information, such as the operating system architecture, computer name, CPU, memory, and uptime. The data is then exported using predefined Slack channels and Telegram chats.

The attackers hid the address of the command and control (C2) server in a smart contract on the Sepolia Ethereum testnet blockchain.

“The contract exposes getter and setter functions that the malware controls rather than simply requesting a domain,” the Checkmarx researchers said. “This technique is more resistant to domain/IP removal than traditional C2 approaches, as it uses the smart contract as a pointer to a new address whenever the old one is removed.”

See also: GitHub disables npm install scripts to protect against attacks

Further down the chain, the malware generates cryptographic keys to establish a shared secret with a public key retrieved from the blockchain. This secret is ultimately used to unlock a second-stage payload of two encrypted chunks in the smart contract.

Checkmarx did not say what the second-stage loader does, but noted that the malware cleans up its tracks. It contains “functionality to delete malware files and remove the activation code from the main prototype operation,” the researchers noted.

Nine more packages expand the campaign

Checkmarx also identified nine other npm packages associated with the campaign, which were subsequently removed from the registry. These included ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, and sliding-score-window. Several of these packages had hundreds of thousands of downloads, while btree-core had more than 1.9 million downloads.

The operators attempted to make the package ecosystem appear legitimate, Checkmarx noted, by maintaining a GitHub repository with numerous commits while keeping the malicious code outside the repository. The associated GitHub account also used an AI-generated profile picture.

See also: SLEEPWALKER Backdoor: New sophisticated malware for Windows

Checkmarx said the campaign is ongoing and its findings may change as the investigation progresses. It shared a list of indicators of compromise (IOCs) for security teams to use in detection and monitoring.