# indexed-btree npm Campaign: Runtime-Triggered Loader Evades Install-Script Defenses via BTree.prototype.set()

> Checkmarx Zero identified indexed-btree and nine related npm packages (combined ~5.3M+ weekly downloads) that plant a malware loader inside the runtime-executed BTree.prototype.set() method instead of install lifecycle scripts, evading npm v12's script-approval gate and static/taint-analysis scanners. Once triggered by a specific key value, the loader exfiltrates host data via Slack and Telegram and pulls an X25519/AES-protected second-stage payload from an Ethereum Sepolia smart contract acting as blockchain-based C2.

- **Published:** 2026-09-20T00:00:00Z
- **Last reviewed:** 2026-09-20T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2590
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-indexed-btree-runtime-loader-npm-tl-2026-2590.webp?v=438bd5c9 (Threadlinqs threat intel: indexed-btree npm Runtime Attack: Detection & IOCs (TL-2026-2590) — High severity, 19 IOCs, 9 detection rules.)
- **ID:** TL-2026-2590
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 19

## Description

In September 2026, Checkmarx Zero researchers disclosed a supply-chain campaign built around the npm package indexed-btree, which impersonates the popular sorted-btree library (impersonated package reached roughly 2 million weekly downloads at its peak) and nine sibling packages published from the same operator: ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, and sliding-score-window, together accounting for over 5.3 million combined weekly downloads. All ten were removed from the npm registry following disclosure.

The campaign's defining innovation is where the malicious logic lives. In June 2026, GitHub/npm announced that npm v12 would require explicit developer approval before executing dependency lifecycle scripts (preinstall, install, postinstall), a measure that rolled out fully by July 2026 specifically to block install-time supply-chain malware. indexed-btree ships with no lifecycle scripts at all, so npm's approval gate never engages. Instead, the operators grafted the loader directly into BTree.prototype.set(), the library's core write method that every consuming application calls constantly during normal operation. The public GitHub repository (org INDEXED-BTREE, maintainer account charlessadler25, whose profile photo is AI-generated) never contains the malicious code; the divergence exists only in the tarball published to the npm registry, which ships an additional extended/ directory containing the obfuscated first-stage loader sharedLoad.min.js. The loader activates only when the host application calls .set() with a key that loosely equals 100, a narrow trigger condition designed to evade both static/taint-analysis tooling and sandboxed dynamic-analysis runs that don't happen to exercise that exact code path.

Once triggered, the first stage collects system reconnaissance data (OS architecture, hostname, CPU details, memory, uptime) and exfiltrates it via a hardcoded Slack bot token/channel and a hardcoded Telegram bot token/chat ID. It then spawns a detached Node child process (stdio: 'ignore', windowsHide: true) that polls a smart contract deployed on the Ethereum Sepolia testnet, reading state written by the operators through the contract's setter functions. Communication uses X25519 elliptic-curve Diffie-Hellman key exchange against a hardcoded operator public key to derive a shared secret, which is used to AES-decrypt a second-stage payload stored as on-chain ciphertext. This blockchain-based C2 design leaves no domain to sinkhole and no server to seize. The malware can self-delete and remove the runtime trigger from the package's code to eliminate forensic traces.

Fabricated commit history on the GitHub organization dates back to December 2025, with periodic housekeeping and documentation commits through mid-2026 used to build apparent legitimacy for the package ahead of the malicious tarball's wide distribution. Snyk published an advisory marking all versions of indexed-btree as malicious (CWE-506, Embedded Malicious Code) on September 7, 2026; Checkmarx Zero published the full technical breakdown on September 17, 2026, attributing the operation to an Ethereum wallet holding 109 ETH (~€230,933 at disclosure) with no confirmed direct theft and no named threat actor or group. BleepingComputer's public report on September 20, 2026 confirmed all ten packages had been removed from npm.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1195.001 Compromise Software Dependencies and Development Tools
- T1059.007 JavaScript
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 File Deletion
- T1036.005 Match Legitimate Resource Name or Location
- T1608.001 Upload Malware
- T1585.001 Social Media Accounts
- T1082 System Information Discovery
- T1102.002 Bidirectional Communication
- T1573.002 Asymmetric Cryptography
- T1071.001 Web Protocols
- T1567.004 Exfiltration Over Webhook

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Malicious indexed-btree npm Package Family Installed (Build/CI Pipeline)** (`TL-2026-2590-SPL-001`)

Detects installation of any of the ten indexed-btree-family npm packages (indexed-btree, ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, sliding-score-window) recorded in npm install logs, CI build logs, or generated SBOMs. All ten were removed from the npm registry after Checkmarx Zero disclosed a runtime-triggered supply-chain loader embedded in BTree.prototype.set().

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195, T1195.001, T1036.005
- **Data sources:** npm_install_logs, cicd_build_logs, sbom_cyclonedx
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=cicd sourcetype IN ("npm:install","build:logs","sbom:cyclonedx")
| eval package_name=coalesce(package_name, pkg, name)
| where package_name IN ("indexed-btree","ordered-kv-index","btree-leaderboard","priority-slot-queue","btree-range-store","btree-core","btree-time-index","btree-lru-cache","neighbor-key-map","sliding-score-window")
| stats count min(_time) as first_seen max(_time) as last_seen values(version) as versions by package_name, host, project, ci_user
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has "node_modules"
| where FolderPath has_any ("indexed-btree","ordered-kv-index","btree-leaderboard","priority-slot-queue","btree-range-store","btree-core","btree-time-index","btree-lru-cache","neighbor-key-map","sliding-score-window")
| where FileName endswith "package.json"
| project Timestamp, DeviceName, InitiatingProcessAccountName, FolderPath, FileName, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: Malicious indexed-btree npm Package Family Installed
id: a1c3f9e2-4b7d-4a1e-9c3f-2e8b7d1a5f6c
status: experimental
description: Detects installation of the indexed-btree npm package family (10 packages) identified by Checkmarx Zero as embedding a runtime-triggered supply-chain loader inside BTree.prototype.set(), evading npm v12 install-script approval gates.
references:
  - https://zero.checkmarx.com/supply-chain-attack-using-ethereum-smart-contracts-to-distribute-multi-platform-malware-b01ab62b3bab
  - https://www.bleepingcomputer.com/news/security/malicious-npm-packages-evade-install-script-defenses-at-runtime/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/09/20
tags:
  - attack.initial-access
  - attack.t1195
  - attack.t1195.001
  - attack.t1036.005
  - cwe.506
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/node_modules/indexed-btree/'
      - '/node_modules/ordered-kv-index/'
      - '/node_modules/btree-leaderboard/'
      - '/node_modules/priority-slot-queue/'
      - '/node_modules/btree-range-store/'
      - '/node_modules/btree-core/'
      - '/node_modules/btree-time-index/'
      - '/node_modules/btree-lru-cache/'
      - '/node_modules/neighbor-key-map/'
      - '/node_modules/sliding-score-window/'
  condition: selection
falsepositives:
  - Legitimate historical installs performed before the September 2026 npm registry takedown; verify package version and publish date before alerting
level: high
```

**Known false positives:**

- Legitimate historical installs recorded before the npm registry takedown on 2026-09-20; confirm package version and rebuild the dependency tree from a clean lockfile

**Tuning notes:** Feed the exact ten package names from a maintained deny-list (rotate as new sibling packages from the same operator surface) and alert on any lockfile/SBOM diff introducing them, not just fresh installs.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Obfuscated sharedLoad.min.js Loader Dropped via [indicator] Tarball (locked: unlock with TL Creds)
- System Reconnaissance Exfiltration via Telegram Bot API from Node Process (locked: unlock with TL Creds)
- X25519/AES Encrypted Second-Stage Payload Retrieval from Blockchain C2 (locked: unlock with TL Creds)
- Runtime Trigger of Embedded npm Supply-Chain Loader (BTree.set key≈100) (locked: unlock with TL Creds)
- Detached node.exe Child Process Spawned with Hidden Window (Anti-Forensic Staging) (locked: unlock with TL Creds)
- Repeated DNS Resolution to Blockchain RPC Providers from Non-Web3 Host (locked: unlock with TL Creds)
- System Reconnaissance Exfiltration via Slack Bot API from Node Process (locked: unlock with TL Creds)
- Node Process Polling Ethereum Sepolia Smart Contract via RPC (Blockchain C2) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Malicious npm packages evade install-script defenses at runtime](https://www.bleepingcomputer.com/news/security/malicious-npm-packages-evade-install-script-defenses-at-runtime/)
- [Supply Chain Attack Using Ethereum Smart Contracts to Distribute Multi-Platform Malware (indexed-btree technical breakdown)](https://zero.checkmarx.com/supply-chain-attack-using-ethereum-smart-contracts-to-distribute-multi-platform-malware-b01ab62b3bab)
- [Malicious indexed-btree npm Package Bypasses npm v12 Security](https://thecybersecguru.com/news/indexed-btree-npm-malware-runtime-attack-bypasses-npm-v12/)
- [npm indexed-btree Malware Bypasses Install-Script Controls](https://windowsforum.com/news/npm-indexed-btree-malware-bypasses-install-script-controls.445151/)
- [Malicious npm Packages Bypass Install-Script Defenses at Runtime](https://www.news4hackers.com/malicious-npm-packages-bypass-install-script-defenses-at-runtime/)
- [Malicious npm packages evade install-script defenses at runtime](https://blog.netmanageit.com/malicious-npm-packages-evade-install-script-defenses-at-runtime/)
- [Malicious npm packages evade install-script defenses at runtime - Threat Radar](https://radar.offseq.com/threat/malicious-npm-packages-evade-install-script-defenses-at-runtime-bd6632abcdaf0649)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2590