~/news/2026-09-03-indexed-btree-npm-runtime-malware.md

What happened. GitHub published advisory GHSA-f3xx-wvxc-5vh4 for indexed-btree, an npm package built to look like sorted-btree, the legitimate B-tree indexing utility. Every version is affected, no patched version exists, and npm has replaced the listing with a 0.0.1-security placeholder. Reporters counted close to two million weekly downloads; nine sibling packages were removed with it.

Why it matters. Teams read two signals as safety: no install, preinstall, or postinstall script, and a live GitHub repository. indexed-btree satisfied both without earning either. Its manifest has no hooks, and its repository is populated but clean, because the malicious code exists only in the published tarball. The install-script rules left a belief that was never a safety property: here the payload moved from the install stage to the first call of a library method, a small change for an attacker, a large one for a defender.

Mechanism. The loader sits in the library's own BTree.prototype.set method, the write path every consumer calls, behind a comparison of the key to an ordinary number. When it holds, a detached Node process loads an obfuscated file shipped with the package. That stage beacons host details to a Slack channel and a Telegram chat, then polls a contract on the Ethereum Sepolia testnet for instructions instead of a domain that can be seized. It derives a session key from an X25519 exchange with a public key stored in the contract, decrypts two ciphertext blobs, and merges them into a second stage. It also carries code to delete its files and strip the trigger.

What to do. Search the resolved tree, lockfiles, CI logs, container layers, and caches for indexed-btree and the sibling names, and treat any host that ran it as compromised, not dirty. No fixed version exists, so patching does not apply here. Rotation from a separate machine is the real work. Pinning a lockfile changes what resolves next time, not what already ran.