Poisoned Pipeline / Incidents / AS25
indexed-btree runtime npm loader
Checkmarx documented an npm campaign around indexed-btree (about 2 million
weekly downloads, impersonating sorted-btree) whose package.json had no
install scripts. The loader lives in BTree.prototype.set and fires when
the application uses the library (key == 100). Stage-1 fingerprints the
host and beacons Slack/Telegram; C2 is an Ethereum Sepolia contract;
stage-2 is X25519/ECDH-unwrapped on-chain. Nine sibling packages reached
366k–1.95M downloads. Blocking lifecycle scripts only moved the payload
from install time to import time. ReversingLabs (6 Oct 2026) recapped
the same package and said the command-and-control infrastructure was
still running.
Mapped techniques
- T0129 Typosquatting
- T0141 Fake developer reputation (Starjacking)
- T0109 Publish malicious artifact
- T0159 Malicious artifact execution
- T0176 Disable or misconfigure security measures
supply-chain npm indexed-btree and siblings
Impersonated the legitimate sorted-btree library.
A legitimate-looking GitHub repo with fabricated commit history;
the repo never contained the malicious code.
indexed-btree plus nine siblings were published to npm.
Execution was on library use, not on npm install — npm v12's
install-script block never saw it.
The malware could delete its files and strip the trigger from the
prototype after running.
Framework gaps noted
- Runtime-hidden loaders that skip install hooks are still modeled as T0159 rather than a dedicated technique.