Malicious npm package hides malware in runtime behavior

Checkmarx researchers identified an ongoing npm malware campaign using the package indexed-btree, which impersonates the legitimate sorted-btree library. The package avoids install scripts and instead triggers a loader through its runtime BTree.prototype.set method, bypassing npm v12's install-time approval controls. BleepingComputer reports that Checkmarx linked nine additional packages to the operation and that npm removed them. The malware can collect system details and retrieve a second-stage payload.