Malicious npm package indexed-btree fires its loader from a runtime library call

BTree.prototype.set() is the write path of a sorted-map library, so an application that uses indexed-btree calls it repeatedly. Checkmarx says the loader sits inside that method and fires when the caller passes a specific key value ^[6]. "The malware loader hides inside the library's own BTree.prototype.set method, which is the main function that every user would call constantly," Checkmarx said ^[8]. The firm called the approach "a well-built way to sneak past standard taint-analysis tools and most static scanners" ^[9].

GitHub built the June 2026 npm controls after repeated supply-chain attacks on open-source ecosystems since late 2025 ^[22]. They work against install-script malware, and indexed-btree does not need an install script, so npm v12's approval flow has nothing to approve ^[6][7].

Checkmarx advises developers to stop relying on install-time scanning alone and to add runtime behavioral analysis ^[17]. That buys partial coverage: the loader waits on a specific key value, so a sandbox that imports the package and exercises it will watch ordinary btree operations unless the key it writes happens to match ^[6].

indexed-btree stood at 2 million weekly downloads when Checkmarx flagged it ^[2]. The nine related packages Checkmarx had removed from npm ^[14] add up to 5,375,635 downloads between them, with btree-core accounting for 1,951,274 of that ^[15][19]. BleepingComputer did not say what period its figures for the nine cover ^[21]. Six of the ten package names contain the string btree ^[23]. A dependency-tree search on that string covers most of the set.

Checkmarx says the operators built a legitimate-looking GitHub repository, populated its commit history and curated the developer account ^[13]. The firm also ties a wallet holding 109 ETH to the operation, without attributing those funds to cryptocurrency theft in the report ^[3].