Malicious npm package with 2M weekly downloads hides payload in BTree function

September 21, 2026 at 07:56 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

A malicious npm package reached over 2 million weekly downloads by hiding its payload in a routine library function rather than an install script. The malware exfiltrates host data via Slack and Telegram and uses a Sepolia Ethereum testnet smart contract for command-and-control. Checkmarx researchers identified nine additional packages linked to the campaign, all removed from the registry.

Key Facts

The malicious package reached over 2 million weekly downloads.
The payload was embedded in the BTree.prototype.set runtime method, not an install script.
The malware exfiltrates host data via hardcoded Slack channel and Telegram chats.
The C2 server address is hidden in a smart contract on the Sepolia Ethereum testnet.
Checkmarx identified nine additional packages linked to the campaign, including btree-core with over 1.9 million downloads.

Infection Mechanism

The malicious script was embedded directly into the BTree.prototype.set runtime method instead of an install hook in package.json. When the method receives a particular key value, the code launches an obfuscated first-stage loader as a detached Node.js process. The loader fingerprints the host, collecting operating system architecture, hostname, CPU, memory, and uptime. The data is exfiltrated using hardcoded Slack channel and Telegram chats.

Blockchain Command-and-Control

The attackers hid the command-and-control server address in a smart contract on the Sepolia Ethereum testnet blockchain. Checkmarx researchers said the contract exposes getter and setter functions that the malware polls instead of requesting a plain domain. This technique is more resilient to domain or IP takedown than traditional C2 approaches, since the smart contract acts as a pointer to a new address whenever the old one is taken down. The malware creates cryptographic keys to establish a shared secret with a public key retrieved from the blockchain, which unlocks a second-stage payload from two encrypted chunks in the smart contract.

Campaign Scope and Attribution

Checkmarx identified nine other npm packages linked to the campaign, which were subsequently removed from the registry. These included ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, and sliding-score-window. Several of these packages had hundreds of thousands of downloads, while btree-core had more than 1.9 million downloads. The operators maintained a GitHub repository with numerous commits while keeping the malicious code out of the repository, and the associated GitHub account used an AI-generated profile image. Checkmarx said the campaign is ongoing and shared indicators of compromise for security teams.