Checkmarx Finds 10 npm Packages Hiding Malware After 2 Million Weekly Downloads
Updated
Updated · InfoWorld · Sep 21
Checkmarx Finds 10 npm Packages Hiding Malware After 2 Million Weekly Downloads
3 articles · Updated · InfoWorld · Sep 21
Summary
Indexed-btree and nine related npm packages were removed after Checkmarx found they hid malware in normal runtime code, not in preinstall or postinstall hooks that defenders commonly block.
The main package had been downloaded nearly 2 million times a week and stayed live for about 11 weeks before its Sept. 3 removal, showing the campaign evaded npm’s tighter lifecycle-script controls introduced in June.
A booby-trapped BTree.prototype.set method launched a detached Node.js loader that fingerprinted infected hosts and exfiltrated data through hardcoded Slack channels and Telegram chats.
The malware used a smart contract on Ethereum’s Sepolia testnet to fetch command-and-control details and unlock an encrypted second-stage payload, making takedowns harder than with fixed domains or IPs.
Checkmarx said the campaign is still ongoing; several linked packages logged hundreds of thousands of downloads, and the operators also maintained a seemingly legitimate GitHub project to build trust.