A recent discovery has revealed that a malicious npm package, indexed-btree, cleverly concealed its harmful actions within application runtime code. This tactic marks a shift in strategy by cybercriminals, who are adapting to new security measures that limit lifecycle script exploitation.
New Tactics in Malware Distribution
The indexed-btree package mimicked a legitimate utility, sorted-btree, to infiltrate systems. Unlike previous attacks, which exploited install scripts, this package relied solely on runtime execution. The change comes in response to npm’s updated security protocols that block automatic script execution during installation.
Initially uploaded in June 2026 by user charlessadler25, the package quickly gained traction, accumulating millions of downloads. The operation reportedly netted the attackers nearly €230,933.57 in cryptocurrency, highlighting the financial motive behind the campaign.
Technical Details of the Attack
Checkmarx, a software security firm, identified that the malicious code was embedded in the BTree.prototype.set() method, activating a payload from sharedLoad.min.js. This script executed various malicious activities, including system fingerprinting and data transmission to external platforms like Slack and Telegram.
Furthermore, the malware utilized the EtherHiding technique to download encrypted data blobs from a blockchain smart contract, eventually compiling them into a secondary payload. This sophisticated maneuver demonstrates the attackers’ advanced capabilities in circumventing traditional security measures.
Broader Implications and Defense Strategies
The discovery of indexed-btree illustrates a broader shift in threat actor tactics. As attackers develop new methods to bypass security, defenders must enhance their strategies. Experts advise implementing runtime behavior analysis in addition to traditional install-time scanning to detect and mitigate threats.
Ensar Seker, CISO at SOCRadar, emphasizes the importance of layered security controls, noting that attackers continually adapt to changes. While blocking lifecycle scripts is beneficial, additional measures are necessary to identify and stop malicious activities at every stage.
PolinRider: A Parallel Threat
In a related development, a malicious campaign dubbed PolinRider has been identified on Packagist. The campaign involves compromising developer accounts to inject harmful code into repositories. This method leverages routine developer actions as triggers, further complicating detection efforts.
Security researcher Karlo Zanki reported that the compromised Visanduma GitHub organization has been affected since mid-June 2026. The attack employed obfuscated JavaScript executed via PHP, showcasing the adaptability of threat actors in targeting development environments.
The ongoing threat landscape underscores the need for comprehensive security measures that address both pre-installation and runtime threats. As attackers continue to evolve, the software community must remain vigilant and proactive in defending against these sophisticated attacks.
