A fake npm library pulled 2 million downloads a week by hiding malware in its own code

A malicious package called indexed-btree impersonated the legitimate sorted-btree library on JavaScript's most-used package registry, npm, and reached nearly 2 million weekly downloads before being pulled on September 3, 2026, according to security vendor Checkmarx.

The package lived for roughly 11 weeks before takedown, an unusually long dwell time for a typosquat on a public registry, per independent analysis by Blogspan's Alexander Baumgärtner.

Earlier npm malware hid in preinstall and postinstall scripts, the lifecycle hooks the registry runs when a developer types npm install. After npm tightened those scripts in June 2026, this campaign hid its payload in a runtime function instead: a method called BTree.prototype.set fires an obfuscated first-stage loader only when the library is actually used.

That first stage fingerprints the host (operating system, hostname, CPU, memory, uptime), exfiltrates the data over hardcoded Slack and Telegram channels, and pulls a command-and-control address from a smart contract on Ethereum's Sepolia testnet, Checkmarx's write-up says. The contract exposes a getter the malware polls in place of a plain domain, so IP takedowns are less effective, and a second-stage payload is decrypted using a key recovered from the same blockchain record.

Checkmarx did not publicly disclose what that second-stage loader does. The package's npm registry page now shows the takedown; the threat model the campaign leaves behind is the bigger question.