The indexed-btree npm package can trigger malware during normal application activity
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Tuesday, September 22nd, 2026.
Projects using the indexed-btree N P M package may have executed malware during ordinary application activity. The package copied the identity of the legitimate sorted-btree library and recorded almost two million weekly downloads. However, it didn’t use a preinstall or postinstall script. Instead, the malicious loader was placed inside a common library method and waited until an application used that method.
Once triggered, the code profiled the host, contacted attacker-controlled infrastructure, and retrieved a second-stage payload using information stored in a blockchain contract. This design matters because security checks focused only on package installation could miss the threat entirely.
Download totals don’t show how many systems actually ran the malicious path, so teams need to distinguish between packages that were installed and packages used in a running process. Leaders should require ownership and approval for dependencies. Defenders should search source trees, lockfiles, build images, developer systems, and continuous-integration environments for indexed-btree. Remove the package, rotate potentially exposed secrets, and investigate runtime and network evidence on systems that used it. The wider pattern is supply-chain malware hiding inside expected application behavior.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
