Loading story…
A counterfeit npm package, indexed-btree, impersonated the legitimate sorted-btree library and embedded malicious logic in BTree.prototype.set() rather than using install-time lifecycle hooks. The payload activated during ordinary application use when a key equal to 100 was inserted and extended/sharedLoad.min.js was present, allowing it to evade npm v12 controls designed to require approval for lifecycle scripts.
The obfuscated loader fingerprinted affected hosts and exfiltrated reconnaissance to hard-coded Slack and Telegram endpoints. It used an Ethereum Sepolia testnet smart contract for resilient command-and-control and encrypted second-stage payload delivery, deriving AES keys through X25519/ECDH; it also removed injected code and malicious files to reduce forensic evidence. Checkmarx linked the activity to nine additional removed packages and the earlier mutex-forge package through shared blockchain infrastructure; the associated packages had millions of downloads, and operators reportedly accumulated 109 ETH through the smart contract.
Trace attribution and downstream blast radius.
3 events from the most recent confirmed update back to the earliest known activity.
Checkmarx Zero published analysis of a campaign in which counterfeit indexed-btree impersonated sorted-btree and executed an obfuscated loader through BTree.prototype.set() during normal runtime use, bypassing npm v12 lifecycle-script controls. The analysis linked the campaign to nine additional packages and described Slack/Telegram exfiltration, Ethereum Sepolia smart-contract C2, encrypted second-stage delivery, and self-erasure behavior.
Snyk published an advisory identifying all versions of the npm package indexed-btree as malicious under CWE-506. The affected published versions were reported as 2.1.1 through 2.1.3.
Following disclosure, the npm registry replaced indexed-btree with a 0.0.1-security holding stub.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
thecybersecguru.com
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers hijacked the GitHub account of maintainer Jared Wray and used legitimate GitHub Actions workflows to publish malicious npm releases for **`keyv`** and multiple **cacheable-family** packages, seeding a supply-chain worm now described as **ChainDrop**, a variant of **Shai-Hulud**. Researchers said the campaign expanded from an initial set of 11 malicious releases to **444 infected packages**, touching dependencies such as **`keyv`**, **`flat-cache`**, and **`cache-manager`** that together see roughly **2 billion monthly downloads**. The poisoned packages carried valid GitHub-signed provenance, but the malicious payload was inserted into npm tarballs and obfuscated `preinstall` paths, allowing the attack to evade checks that rely on source-repository visibility. The malware stole **npm tokens, GitHub credentials, cloud keys, environment variables, shell data, and secrets from memory**, then encrypted and exfiltrated the data after resolving command-and-control infrastructure through an **Ethereum smart contract**. It also planted persistence in repository and IDE configuration files including **`.claude/settings.json`** and **`.vscode/tasks.json`**, meaning simply opening a seeded repository in tools such as VS Code or Claude Code could trigger compromise and further spread. With stolen GitHub access, the worm enumerated repositories and branches, committed malicious configuration files, and installed a revocation-triggered kill switch tied to stolen tokens; defenders were urged to roll back to known-safe versions, inspect branches for unauthorized config changes, remove persistence before revoking credentials, and treat any host that installed affected packages or opened a seeded repository as compromised.
Aug 22, 2026
Ten malicious versions of **@7nohe/openapi-react-query-codegen**, a TanStack Query code generator with more than 150,000 weekly downloads, were published after an external GitHub user exploited its release workflow. The workflow accepted an exact npm-publish comment from any pull-request participant, checked out untrusted pull-request code, and used the repository's GitHub Actions OIDC trusted-publishing identity to release it; consequently, the malicious packages carried valid npm provenance attestations. At the time of reporting, npm's `latest` tag reportedly referenced malicious version `3.0.4`. The releases execute code during installation through preinstall hooks, malicious `binding.gyp` logic evaluated by `node-gyp`, or both, then launch an obfuscated second-stage payload. The malware downloads and executes Bun, probes Google Cloud metadata services, harvests credentials from cloud, GitHub, package registries, containers, Kubernetes, Vault, cryptocurrency wallets, messaging, VPN, and AI-development tools, and can propagate through accessible development environments; stolen data is exfiltrated through GitHub repositories labeled “Trinitite: Sponsored by Preview 2 Effects.” Organizations that installed affected versions with lifecycle scripts enabled should isolate and rebuild impacted systems, remove persistence and cached artifacts, and rotate all potentially exposed credentials from a clean environment using reviewed lockfiles and known-good releases.
Sep 1, 2026
Attackers linked by multiple researchers to **TeamPCP** hijacked the npm maintainer account `atool` and used it to publish roughly **639 malicious versions across 323 packages**, heavily impacting Alibaba’s **`@antv/*`** ecosystem as well as packages such as `echarts-for-react`, `timeago.js`, and `size-sensor`. Reports said the malware executed through malicious `preinstall` hooks and an obfuscated Bun-based payload, stealing secrets from developer workstations and CI/CD systems including GitHub, npm, AWS, Kubernetes, Vault, SSH, Docker, and database credentials. The campaign also abused GitHub tokens to create attacker-controlled repositories for exfiltration, scraped GitHub Actions runner memory for plaintext secrets, and in some cases targeted trusted tooling including a briefly compromised **Nx Console** VS Code extension. Researchers said the operation was worm-like and self-propagating, using stolen npm tokens to tamper with and republish additional packages under legitimate maintainer identities, with the broader **Mini Shai-Hulud** activity now tracked across npm, PyPI, and Composer. The malware reportedly established persistence in developer environments through modified VS Code and Claude Code settings and OS-level services, while some reports warned it also attempted to forge valid **Sigstore/SLSA provenance** using stolen CI identities. In response, **npm invalidated all write-enabled granular access tokens that bypassed two-factor authentication** and introduced **Staged Publishing** in preview, but researchers warned that any machine or pipeline that installed affected versions should be treated as fully compromised and all reachable credentials rotated immediately.
Jun 29, 2026