indexed-btree: npm Supply Chain Malware Executes at Runtime and Uses a Smart Contract on Ethereum Sepolia for C2

Indexed-btree Malware Campaign Infects Millions of Downloads Without Install Script, Utilizing Ethereum Smart Contract for Command and Control

A malicious npm package named indexed-btree has affected a vast number of downloads, according to cybersecurity firm Checkmarx. The campaign does not require an install script, as the malware launches from within a normal library method. Indexed-btree reached nearly 2 million weekly downloads and is capable of exfiltrating host information, resolving command and control (C2) destinations via smart contracts on Ethereum Sepolia, and decrypting an encrypted second-stage payload.

The attackers disguised indexed-btree as the legitimate sorted-btree package. Once the malicious package was installed, the loader was triggered when the BTree.prototype.set() method was called with key equal to 100. This loader sent host information to Slack and Telegram and retrieved the C2 destination and encrypted blobs from a smart contract on Ethereum Sepolia.

The loader collected system information such as OS architecture, hostname, CPU, memory, and uptime, and sent them to Slack and Telegram channels. It also polled the Ethereum smart contract to obtain the C2 destination. The loader generated an X25519 key pair and retrieved the attacker's public key from the smart contract. Using the ECDH shared secret, it derived an AES key, decrypted and combined two ciphertexts within the smart contract to construct the second-stage payload.

The attackers had the capability to switch the connection target by updating the value on the smart contract side. The loader also contained cleanup functionality that could delete malicious files and remove the trigger from the prototype method. Victims of the campaign are those who installed the package without any explicit warnings about installation scripts.

Administrators would see indexed-btree or related packages listed as dependencies, along with traces of detached child processes spawned by Node.js and network traffic to Slack, Telegram APIs, and Ethereum Sepolia RPC endpoints.

Success conditions included the introduction of the malicious package as a dependency and its loading in a real Node.js environment. Failure conditions could be prevented by pinning approved packages and versions, validating lockfiles, registry metadata, and fetched tarball digests to reject malicious dependencies before installation, and monitoring normal package execution paths and child process generation.