Malicious npm packages move execution from install hooks into runtime code

Researchers found a malicious npm package called indexed-btree that concealed its loader inside an ordinary runtime method, bypassing defenses focused on installation scripts. The package, which mimicked sorted-btree, triggered an obfuscated payload when its B-tree set method ran, fingerprinted the host and contacted Slack and Telegram infrastructure. The malware then retrieved encrypted stages from a smart contract on the Sepolia test network and deleted artifacts to hide its activity. Indexed-btree and ten other packages tied to the operation have been removed from npm. Download counts and an estimate of €230,933.57 in cryptocurrency proceeds do not establish how many systems were infected.