Malicious npm Package With 2 Million Downloads Hides Malware in Runtime Code

A malicious npm package that appeared to be an ordinary data-indexing tool has exposed a weakness in software supply-chain defenses.

The package, indexed-btree, copied the identity of the legitimate sorted-btree library and recorded almost two million weekly downloads. The campaign is notable because the malware does not need to run while a developer installs it.

Instead, it waits inside normal application code and activates when the library is used, turning a trusted dependency into a route for host profiling, data theft, and follow-on payload delivery. Researchers at Checkmarx identified the activity.

Checkmarx said in a report shared with Cyber Security News (CSN) that the operation shows why checks focused only on install scripts can miss threats that execute later.