Malicious npm packages evade install-script defenses at runtime

A malicious npm campaign distributed counterfeit packages, including 'indexed-btree', designed to mimic the legitimate 'sorted-btree' library. The threat evades npm's install-script restrictions by embedding malicious logic in runtime code—specifically within the BTree.prototype.set() method—triggering execution only when called with a specific key. The malware collects system information, exfiltrates it via Slack and Telegram, and communicates with a C2 server through an Ethereum smart contract on the Sepolia test network using encrypted payloads. The attackers also created nine additional malicious packages with fabricated repositories and commit histories to appear legitimate.

AI-extracted · verify before operational use