Malicious npm Package 'indexed-btree' Disguised as Legitimate Utility

Checkmarx researchers have uncovered a malicious npm package named 'indexed-btree' that mimicked the legitimate 'sorted-btree' package, an ordinary B-tree/indexing utility. The package was designed to deceive developers into installing it, believing it to be a legitimate tool for database indexing and tree structures.

Unlike many malicious npm packages that rely on lifecycle scripts (such as install, prepublish, or postinstall) to execute malicious code, 'indexed-btree' hid its malicious behavior within runtime application code. This tactic indicates that threat actors are likely shifting their approaches in response to increased monitoring of npm lifecycle events.

The package has been removed from the npm registry. However, developers who have already installed the package are advised to audit their node_modules and ensure they are using the legitimate 'sorted-btree' package from official sources. The exact nature of the runtime payload is not detailed in the report, but potential impacts could include credential theft, data exfiltration, or system compromise depending on the logic executed.