indexed-btree npm Campaign: Runtime-Triggered Loader Evades Install-Script Defenses via BTree.prototype.set()

Key facts for indexed-btree runtime loader npm

Detection coverage for indexed-btree runtime loader npm

As of 2026-09-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2590 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Malicious indexed-btree npm Package Family Installed (Build/CI Pipeline)

Detects installation of any of the ten indexed-btree-family npm packages (indexed-btree, ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, sliding-score-window) recorded in npm install logs, CI build logs, or generated SBOMs. All ten were removed from the npm registry after Checkmarx Zero disclosed a runtime-triggered supply-chain loader embedded in BTree.prototype.set().

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195, T1195.001, T1036.005
• Data sources: npm_install_logs, cicd_build_logs, sbom_cyclonedx
• Severity: high
• Confidence: high

Splunk SPL

index=cicd sourcetype IN ("npm:install","build:logs","sbom:cyclonedx")
| eval package_name=coalesce(package_name, pkg, name)
| where package_name IN ("indexed-btree","ordered-kv-index","btree-leaderboard","priority-slot-queue","btree-range-store","btree-core","btree-time-index","btree-lru-cache","neighbor-key-map","sliding-score-window")
| stats count min(_time) as first_seen max(_time) as last_seen values(version) as versions by package_name, host, project, ci_user
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has "node_modules"
| where FolderPath has_any ("indexed-btree","ordered-kv-index","btree-leaderboard","priority-slot-queue","btree-range-store","btree-core","btree-time-index","btree-lru-cache","neighbor-key-map","sliding-score-window")
| where FileName endswith "package.json"
| project Timestamp, DeviceName, InitiatingProcessAccountName, FolderPath, FileName, SHA256
| order by Timestamp desc

Sigma

title: Malicious indexed-btree npm Package Family Installed
id: a1c3f9e2-4b7d-4a1e-9c3f-2e8b7d1a5f6c
status: experimental
description: Detects installation of the indexed-btree npm package family (10 packages) identified by Checkmarx Zero as embedding a runtime-triggered supply-chain loader inside BTree.prototype.set(), evading npm v12 install-script approval gates.
references:
  - https://zero.checkmarx.com/supply-chain-attack-using-ethereum-smart-contracts-to-distribute-multi-platform-malware-b01ab62b3bab
  - https://www.bleepingcomputer.com/news/security/malicious-npm-packages-evade-install-script-defenses-at-runtime/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/09/20
tags:
  - attack.initial-access
  - attack.t1195
  - attack.t1195.001
  - attack.t1036.005
  - cwe.506
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/node_modules/indexed-btree/'
      - '/node_modules/ordered-kv-index/'
      - '/node_modules/btree-leaderboard/'
      - '/node_modules/priority-slot-queue/'
      - '/node_modules/btree-range-store/'
      - '/node_modules/btree-core/'
      - '/node_modules/btree-time-index/'
      - '/node_modules/btree-lru-cache/'
      - '/node_modules/neighbor-key-map/'
      - '/node_modules/sliding-score-window/'
  condition: selection
falsepositives:
  - Legitimate historical installs performed before the September 2026 npm registry takedown; verify package version and publish date before alerting
level: high

Known false positives:

• Legitimate historical installs recorded before the npm registry takedown on 2026-09-20; confirm package version and rebuild the dependency tree from a clean lockfile

Tuning notes: Feed the exact ten package names from a maintained deny-list (rotate as new sibling packages from the same operator surface) and alert on any lockfile/SBOM diff introducing them, not just fresh installs.

• 🔒 Obfuscated sharedLoad.min.js Loader Dropped via [indicator] Tarball · unlock with TL Creds
• 🔒 System Reconnaissance Exfiltration via Telegram Bot API from Node Process · unlock with TL Creds
• 🔒 X25519/AES Encrypted Second-Stage Payload Retrieval from Blockchain C2 · unlock with TL Creds
• 🔒 Runtime Trigger of Embedded npm Supply-Chain Loader (BTree.set key≈100) · unlock with TL Creds
• 🔒 Detached node.exe Child Process Spawned with Hidden Window (Anti-Forensic Staging) · unlock with TL Creds
• 🔒 Repeated DNS Resolution to Blockchain RPC Providers from Non-Web3 Host · unlock with TL Creds
• 🔒 System Reconnaissance Exfiltration via Slack Bot API from Node Process · unlock with TL Creds
• 🔒 Node Process Polling Ethereum Sepolia Smart Contract via RPC (Blockchain C2) · unlock with TL Creds

Indicators of compromise for indexed-btree runtime loader npm

As of 2026-09-20, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-2590.

How indexed-btree runtime loader npm works

In September 2026, Checkmarx Zero researchers disclosed a supply-chain campaign built around the npm package indexed-btree, which impersonates the popular sorted-btree library (impersonated package reached roughly 2 million weekly downloads at its peak) and nine sibling packages published from the same operator: ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, and sliding-score-window, together accounting for over 5.3 million combined weekly downloads. All ten were removed from the npm registry following disclosure.

The campaign's defining innovation is where the malicious logic lives. In June 2026, GitHub/npm announced that npm v12 would require explicit developer approval before executing dependency lifecycle scripts (preinstall, install, postinstall), a measure that rolled out fully by July 2026 specifically to block install-time supply-chain malware. indexed-btree ships with no lifecycle scripts at all, so npm's approval gate never engages. Instead, the operators grafted the loader directly into BTree.prototype.set(), the library's core write method that every consuming application calls constantly during normal operation. The public GitHub repository (org INDEXED-BTREE, maintainer account charlessadler25, whose profile photo is AI-generated) never contains the malicious code; the divergence exists only in the tarball published to the npm registry, which ships an additional extended/ directory containing the obfuscated first-stage loader sharedLoad.min.js. The loader activates only when the host application calls .set() with a key that loosely equals 100, a narrow trigger condition designed to evade both static/taint-analysis tooling and sandboxed dynamic-analysis runs that don't happen to exercise that exact code path.

Once triggered, the first stage collects system reconnaissance data (OS architecture, hostname, CPU details, memory, uptime) and exfiltrates it via a hardcoded Slack bot token/channel and a hardcoded Telegram bot token/chat ID. It then spawns a detached Node child process (stdio: 'ignore', windowsHide: true) that polls a smart contract deployed on the Ethereum Sepolia testnet, reading state written by the operators through the contract's setter functions. Communication uses X25519 elliptic-curve Diffie-Hellman key exchange against a hardcoded operator public key to derive a shared secret, which is used to AES-decrypt a second-stage payload stored as on-chain ciphertext. This blockchain-based C2 design leaves no domain to sinkhole and no server to seize. The malware can self-delete and remove the runtime trigger from the package's code to eliminate forensic traces.

Fabricated commit history on the GitHub organization dates back to December 2025, with periodic housekeeping and documentation commits through mid-2026 used to build apparent legitimacy for the package ahead of the malicious tarball's wide distribution. Snyk published an advisory marking all versions of indexed-btree as malicious (CWE-506, Embedded Malicious Code) on September 7, 2026; Checkmarx Zero published the full technical breakdown on September 17, 2026, attributing the operation to an Ethereum wallet holding 109 ETH (~€230,933 at disclosure) with no confirmed direct theft and no named threat actor or group. BleepingComputer's public report on September 20, 2026 confirmed all ten packages had been removed from npm.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information

Execution

T1059.007 JavaScript

Command and Control

T1071.001 Web Protocols; T1102.002 Bidirectional Communication; T1573.002 Asymmetric Cryptography

Discovery

T1082 System Information Discovery

Initial Access

T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools

Exfiltration

T1567.004 Exfiltration Over Webhook

Resource Development

T1585.001 Social Media Accounts; T1608.001 Upload Malware

Remediation for indexed-btree runtime loader npm

Patches

• No vendor patch applies; all ten malicious packages were removed from the npm registry and must be fully uninstalled and purged from lockfiles/caches

Immediate actions

• Audit lockfiles, SBOMs, container/registry mirrors, and CI caches for any of the ten known-malicious package names: indexed-btree, ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, sliding-score-window
• Preserve node_modules and npm cache directories as forensic evidence before remediation; the malware can self-delete and remove its own trigger
• Block/monitor egress from build and CI systems to the identified Slack bot token/channel, Telegram bot/chat ID, and Sepolia RPC endpoints (Alchemy, Infura)
• Rotate npm publish tokens, GitHub/GitLab/Azure DevOps credentials, cloud provider keys, and CI/CD secrets on any system that ever installed one of the ten packages
• Hunt for orphaned/detached Node child processes spawned with stdio:'ignore' and windowsHide:true, and for the file path /extended/sharedLoad.min.js

Workarounds

• Do not reinstall indexed-btree or any of the nine related packages under any version; migrate to the legitimate sorted-btree library or another actively-maintained B-tree/ordered-map implementation

Longer-term hardening

• Adopt runtime behavioral monitoring (EDR/RASP) for build and developer environments, since npm's install-script-blocking (npm v12) does not cover malicious logic embedded in a dependency's normal runtime code path
• Pin dependency versions and diff SBOMs on every update rather than trusting install-time scanning alone
• Monitor developer and CI hosts for anomalous outbound connections to messaging-platform bot APIs (Slack, Telegram) and blockchain RPC providers, which are not typical developer-tooling traffic

Affected and fixed versions

• npm registry — indexed-btree
  Vulnerable versions: all published versions
  Fixed in: removed from npm registry
• npm registry — ordered-kv-index
  Vulnerable versions: all published versions
  Fixed in: removed from npm registry
• npm registry — btree-leaderboard
  Vulnerable versions: all published versions
  Fixed in: removed from npm registry
• npm registry — priority-slot-queue
  Vulnerable versions: all published versions
  Fixed in: removed from npm registry
• npm registry — btree-range-store
  Vulnerable versions: all published versions
  Fixed in: removed from npm registry
• npm registry — btree-core
  Vulnerable versions: all published versions
  Fixed in: removed from npm registry
• npm registry — btree-time-index
  Vulnerable versions: all published versions
  Fixed in: removed from npm registry
• npm registry — btree-lru-cache
  Vulnerable versions: all published versions
  Fixed in: removed from npm registry
• npm registry — neighbor-key-map
  Vulnerable versions: all published versions
  Fixed in: removed from npm registry
• npm registry — sliding-score-window
  Vulnerable versions: all published versions
  Fixed in: removed from npm registry

Timeline of indexed-btree runtime loader npm

• 2025-12-08 Earliest fabricated commits pushed to the GitHub locked-ioc-16 organization under maintainer account locked-ioc-14 (AI-generated profile photo) to build the package's apparent legitimacy.
• 2026-03-16 locked-ioc-16 version 2.1.1 published to npm; the published tarball (not the public repo) contains the extended/sharedLoad.min.js loader and the BTree.prototype.set() trigger.
• 2026-06-01 GitHub/npm announce npm v12 will block dependency lifecycle scripts (preinstall/install/postinstall), Git dependencies, and remote URLs unless explicitly approved by the project.
• 2026-06-18 Housekeeping commits pushed to the public GitHub repository to preserve the appearance of active, legitimate maintenance.
• 2026-07-01 npm v12 rolls out, enforcing explicit approval for install-time lifecycle scripts; locked-ioc-16's runtime-only trigger design evades this control entirely since it ships no lifecycle scripts.
• 2026-07-15 Further documentation commits made to the public repository, which never contains the malicious loader code found only in the published npm tarball.
• 2026-09-07 Snyk publishes a security advisory marking all versions of locked-ioc-16 malicious under CWE-506 (Embedded Malicious Code), rated high impact across confidentiality, integrity, and availability.
• 2026-09-17 Checkmarx Zero publishes the full technical breakdown, identifying the BTree.prototype.set() trigger, the Slack/Telegram exfiltration channels, the X25519/AES-protected Sepolia smart-contract C2, and attribution to a wallet holding 109 ETH.
• 2026-09-20 BleepingComputer reports the campaign publicly; all ten related packages (locked-ioc-16, locked-ioc-10, locked-ioc-8, locked-ioc-7, locked-ioc-9, locked-ioc-18, locked-ioc-11, locked-ioc-13, locked-ioc-12, locked-ioc-6) have been removed from the npm registry.

Sources cited for indexed-btree runtime loader npm

• Supply Chain Attack Using Ethereum Smart Contracts to Distribute Multi-Platform Malware (indexed-btree technical breakdown) zero.checkmarx.com · Vendor report · 2026-09-17
• Malicious npm packages evade install-script defenses at runtime - Threat Radar radar.offseq.com · Research · 2026-09-20
• Malicious indexed-btree npm Package Bypasses npm v12 Security thecybersecguru.com · Blog · 2026-09-20
• npm indexed-btree Malware Bypasses Install-Script Controls windowsforum.com · Blog · 2026-09-20
• Malicious npm packages evade install-script defenses at runtime blog.netmanageit.com · Blog · 2026-09-20
• Malicious npm packages evade install-script defenses at runtime BleepingComputer · News · 2026-09-20
• Malicious npm Packages Bypass Install-Script Defenses at Runtime news4hackers.com · News · 2026-09-20

More in supply chain

• Software Supply Chain Attacks Overview: CCleaner, Codecov, SolarWinds Orion, npm Shai-Hulud, Kaseya VSA, MOVEit Transfer
• BO Team (Black Owl) Supply Chain Attack Against a Software Developer's Infrastructure (CVE-2021-44228)
• Backdoored ARTEX Docker Hub images (tomicdd/artex and clones) expose 62 consoles to unauthenticated root shell; CERT-In CIAD-2026-0058 flags AI-assisted actor Crafty Falcon
• PolinRider Loader Reappears in Hijacked npm Packages (12 malicious releases across 10 packages)
• NIKKE PC Game Launcher CDN Compromise Delivers K2F Remote Access and Data-Stealing Malware

Previous and next in supply chain

• GHAPPIER Loader: npm Supply-Chain Compromise of @dforge-core/dforge-mcp Linked to DPRK PolinRider Campaign Previous report
• Rust Team Members and Popular Crate Owners Targeted via Fake Job Video Calls (North Korea-Linked) Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages