npm Package Hides Malware in Runtime Code, Checkmarx Says

A malicious npm package named indexedbtree hid its malware inside normal runtime code rather than installation scripts, evading security controls introduced in npm version 12, according to an analysis by Checkmarx. The package, which mimics the legitimate sortedbtree library, reached nearly 2 million weekly downloads before it was removed from the registry on September 3, 2026. Checkmarx linked nine additional npm packages to the same operation, bringing the total to 10. All have since been removed from npm. Among them, btreecore recorded 1,951,274 downloads, while the others each accumulated between roughly 366,000 and 494,000 downloads. Unlike conventional supply chain attacks that rely on preinstall, install, or postinstall hooks, the operators embedded the loader inside BTree.prototype.set, a core library method likely to be invoked during normal application execution. The package's package.json contains no suspicious lifecycle hook, allowing installation to appear benign and avoiding protections introduced in npm v12 that require explicit approval for dependency scripts.