Malicious npm package indexed-btree reached millions of downloads while hiding malware in BTree prototype code

A malicious npm package posing as a legitimate JavaScript library was downloaded millions of times before being flagged, putting developers and any systems that used it at risk. SecurityWeek reports that indexed-btree imitated sorted-btree and hid a trigger in BTree.prototype.set instead of using an install script, helping it evade newer npm protections. Checkmarx linked it to additional packages including sliding-score-window and said the malware sent host data to Slack and Telegram and fetched a second stage from a Sepolia blockchain smart contract used as command-and-control.