Malicious npm packages from the btree family gained millions of downloads by bypassing installation-script protections — 22 September 2026

An ongoing npm supply-chain campaign uses the malicious indexed-btree package, which mimics the legitimate sorted-btree library. The malicious trigger is not in a preinstall or postinstall script; it is embedded in a library prototype method and executes when the library is used. The source reports host fingerprinting and exfiltration through Slack and Telegram, and the use of an Ethereum Sepolia smart contract as a C2 channel. indexed-btree reached almost 2 million weekly downloads; the attackers appear to have earned 109 ETH, approximately €230,933.57.