New npm Threat Bypasses Install Script Protections
A malicious npm package that has been downloaded millions of times comes with a new way of spreading the malware that makes it easier to bypass security protections, say researchers with security vendor Checkmarx. Rather than using more common preinstall or postinstall scripts, the bad actors instead created a malicious package – indexed-btree – that […]
A new malicious npm package, called "indexed-btree," has been identified as a threat that can bypass security protections in the installation process, according to security researchers from Checkmarx. This package has been downloaded over 1.9 million times, making it one of the most widely distributed malicious packages on the npm platform.
Unlike other malicious packages that use preinstall or postinstall scripts, this one hides its malware in the package's runtime code, making it harder to detect. The package has been specifically designed to mimic the legitimate "sorted-btree" package, which it replicates to deceive users.
Once installed, the package launches JavaScript code containing the malware's first stage, which can then fingerprint the host and exfiltrate sensitive information like the operating system architecture, hostname, CPU, and memory. This information is then sent to a hardcoded Slack channel and Telegram chat. In addition, the package uses an Ethereum smart contract on the Sepolia testnet to act as a command-and-control (C2) channel.
This technique is more resilient to takedowns since it uses the smart contract as a pointer to a new address whenever the old one is taken down.
The malicious code can also delete its malware files and remove the trigger code, leaving no trace of its presence. The attacker behind the attack has also created a GitHub repository with realistic commits and an AI-generated photo to make it look more legitimate. Although the repository doesn't contain any malicious code, its existence adds to the overall deception.
Checkmarx estimates that the attacker has managed to collect 109 ETH, which is approximately $264,963. This campaign highlights how attackers are adapting quickly to stronger software supply chain defenses. While npm has implemented improved install-time security by restricting dependency lifecycle scripts, attackers are finding ways to move their malicious execution into legitimate-looking runtime functionality.
Software supply chain security now needs to extend beyond the reputation of packages and include additional measures such as dependency provenance, unexpected code changes, runtime behavior, and outbound network connections.
Written by urgent.news from DevOps.com's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
