What happened
On September 17, 2026, Checkmarx Zero published its analysis of a supply-chain campaign around the npm package indexed-btree, which impersonated the legitimate sorted-btree library, and nine sibling packages from the same operator. Together they had more than 5.3 million weekly downloads. Snyk had flagged all indexed-btree versions as malicious on September 7, and by September 20 all ten packages had been removed.
The packages: indexed-btree, ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map and sliding-score-window.
What's new: runtime malware
Since July 2026, npm v12 requires explicit approval to run install scripts (preinstall, install, postinstall). indexed-btree has no install scripts at all. The loader sits inside BTree.prototype.set(), the method every app calls constantly, and fires only when the key loosely equals 100, making static and sandbox detection harder.
Other reported details:
- the malicious code existed only in the npm tarball, not the GitHub repo;
- the GitHub commit history was fabricated back to December 2025;
- exfiltration via Slack and Telegram, with a second stage pulled from a smart contract on the Ethereum Sepolia testnet, leaving no domain to take down;
- the malware can delete itself.
What to do now
- Search lockfiles, SBOMs, mirrors and CI caches for these names.
- If found, preserve evidence and rotate npm tokens, Git credentials, cloud keys and CI secrets.
- Don't rely only on install-script blocking: monitor runtime behavior on build and developer machines.