Malicious npm Package Skips Install Scripts, Hides Malware in Application Code Instead

Security researchers at Checkmarx have identified a malicious npm package called "indexed-btree," which mimicked a legitimate package called sorted-btree. Rather than using preinstall or postinstall scripts, the traditional method attackers use to run malicious code automatically during installation, this package hid its loader inside a normal-looking function within the application code itself. This approach appears to be a direct response to a recent npm security change that blocks automatic execution of these install scripts.

The package was uploaded in June 2026 and quickly gained millions of downloads before it and its associated GitHub repository were taken down. Once triggered, the hidden code loaded a further payload designed to fingerprint the infected device, send details to attacker-controlled Slack and Telegram channels, and retrieve additional encrypted instructions from a smart contract on a blockchain testnet. The malware then deleted its own traces to avoid detection. Checkmarx estimates the campaign generated over 230,000 Euro in cryptocurrency for the attackers.

This case highlights that attackers are adapting quickly as platforms like npm tighten security around common attack methods, shifting their techniques rather than stopping. Businesses relying on open-source packages need to be aware that malicious code can now be hidden deeper within legitimate-looking functionality, not just in obvious installation scripts.