Ethical Hacking News
Malicious npm packages have been found hiding their malicious behavior within application code, rather than using lifecycle scripts. This latest development marks a significant shift in the tactics employed by threat actors, who are adapting to recent security controls by adopting more sophisticated methods of obfuscation and evasion. To counter the threat, developers are recommended not to stick only to install-time scanning and blocking lifecycle scripts alone, but also employ runtime behavior analysis.
Summary: The rise of sophisticated threat actors in the npm ecosystem has been highlighted by the discovery of a malicious npm package named "indexed-btree" which was found hiding its malicious behavior within application code. The package, which was first uploaded to the registry on June 18, 2026, amassed millions of downloads in a short span of time, generating illicit profits for the threat actor. The development marks a significant shift in the tactics employed by threat actors, who are adapting to recent security controls by adopting more sophisticated methods of obfuscation and evasion.
Malicious npm packages have been found hiding their malicious behavior within application code, evading security controls. The "indexed-btree" package was found to be concealing its malicious behavior, generating €230,933.57 in cryptocurrency. Npm version 12 introduced a security change to prevent automatic execution of lifecycle scripts, which threat actors are now adapting to. Threat actors are shifting tactics, incorporating malicious code directly within the library, rather than using install hooks. Developers are recommended to employ runtime behavior analysis and layered controls to detect malicious behavior before, during, and after deployment.
The world of software development and supply chain security is facing an unprecedented threat, as malicious npm packages have been found hiding their malicious behavior within application code, rather than using lifecycle scripts. This latest development marks a significant shift in the tactics employed by threat actors, who are adapting to recent security controls by adopting more sophisticated methods of obfuscation and evasion.
According to recent findings, a malicious npm package named "indexed-btree" was observed to be hiding its malicious behavior within application code rather than using lifecycle scripts, indicating that threat actors are likely shifting tactics in response to recent security controls. The package, which was first uploaded to the registry on June 18, 2026, by an npm user named "charlessadler25", amassed millions of downloads in a short span of time, generating illicit profits for the threat actor, earning them around €230,933.57 in cryptocurrency (i.e., 109 ETH).
The development comes as npm version 12 introduced a security change to prevent automatic execution of lifecycle scripts such as preinstall or postinstall, which is one of the most common ways malware is executed through packages distributed through the repository. Legitimately, these are often used for compiling necessary code, seeding data, or setting up essential configurations. However, for threat actors, this is frequently exploited to automatically execute malicious code without user consent during the installation of a malicious package.
The latest findings from the software supply chain security company Checkmarx show that bad actors are shifting tactics in response to the change, eschewing install hooks in favor of incorporating the malicious code directly within the library. In this case, the malware loader is concealed inside a "BTree.prototype.set()" method, which then triggers "sharedLoad.min.js," a JavaScript payload that embeds the obfuscated first stage of the malware.
The malware is designed to fingerprint the host, beacon the details to a hard-coded Slack channel and Telegram bot, uses the EtherHiding technique to pull next-stage, encrypted blobs from a smart contract deployed on Sepolia testnet, and finally merge them to form the second-stage payload. The final step involves deleting the malicious artifacts and removing the trigger from the package code to cover up the tracks.
Checkmarx said indexed-btree is one of the many npm packages tied to the same operation, all of which have since been removed from npm - ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, sliding-score-window, mutex-forge. To counter the threat, developers are recommended not to stick only to install-time scanning and blocking lifecycle scripts alone, but also employ runtime behavior analysis.
"What makes this campaign particularly important is that it shows attackers adapting almost immediately to stronger software supply chain defenses," Ensar Seker, CISO at SOCRadar, said in a statement shared with The Hacker News. "Npm has improved install time security by restricting dependency lifecycle scripts, but this campaign demonstrates that attackers can simply move malicious execution into legitimate-looking runtime functionality instead."
"The broader lesson is that security controls change attacker behavior rather than eliminate the underlying threat. Blocking lifecycle scripts is an important improvement, but attackers will continue searching for alternative execution paths. Defenders, therefore, need layered controls capable of detecting malicious behavior before installation, during execution, and after deployment."
This latest development marks a significant shift in the tactics employed by threat actors, who are adapting to recent security controls by adopting more sophisticated methods of obfuscation and evasion. As the software supply chain security landscape continues to evolve, it is essential for developers to stay vigilant and take proactive measures to protect themselves against emerging threats.
Related Information:
https://www.ethicalhackingnews.com/articles/Malicious-npm-Packages-Exposed-The-Rise-of-Sophisticated-Threat-Actors-and-the-Evolving-Nature-of-Supply-Chain-Security-ehn.shtml
https://thehackernews.com/2026/09/malicious-npm-package-indexed-btree-hid.html
Published: Tue Sep 22 07:36:24 2026 by llama3.2 3B Q4_K_M
