Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal
Summary: A malicious npm package called "indexed-btree," mimicking the legitimate sorted-btree utility, hid its loader inside a BTree.prototype.set() method that triggered a sharedLoad.min.js payload rather than using preinstall or postinstall scripts. Uploaded on June 18, 2026, by the npm user "charlessadler25," it amassed millions of downloads before removal and earned the actor roughly €230,933.57 (109 ETH) in cryptocurrency.
Bottom line: The package appeared right as npm version 12 restricted automatic lifecycle script execution, and Checkmarx tied it to a broader operation whose packages have all been removed from npm - so the install-time control that was supposed to stop this class of attack did not, and the actor still walked away with 109 ETH.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026