Affected Systems

npm package 'indexed-btree' (2M weekly downloads) and 9 related packages: ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, sliding-score-window. Affects Node.js developers using these packages in production or development environments.

Exploitation Status

Active exploitation confirmed. Malware operational in the wild since at least September 2026. Packages have been removed from npm registry but may persist in deployed environments. Threat actors use Ethereum smart contracts for C2 and exfiltrate data via Slack/Telegram channels.

Business Impact

Traditional install-time scanning and npm v12 lifecycle script protections are bypassed. Malware executes at runtime via BTree.prototype.set() method, collecting system metadata (architecture, hostname, CPU, memory, uptime) and exfiltrating through hardcoded channels. Attackers can deploy second-stage payloads via encrypted Ethereum smart contract data and remotely wipe traces. Organizations relying solely on install-time security controls are exposed. Secrets and credentials in affected environments are compromised.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately audit package.json and lock files for indexed-btree and the 9 related packages (ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, sliding-score-window); remove if present
  • Rotate all secrets, API keys, tokens, and credentials in environments where any of these packages were installed
  • Restore affected development and production environments from known-clean backups taken before package installation
  • Implement runtime behavioral monitoring and dynamic analysis tools to detect malicious activity during package execution, not just at install time
  • Review outbound network connections to Slack, Telegram, and Ethereum Sepolia testnet from Node.js processes; block or alert on unexpected traffic to these destinations