Malicious npm packages evade install-script defenses at runtime

Checkmarx found the npm package indexed-btree masquerading as sorted-btree: a malicious loader hidden in BTree.prototype.set() runs at runtime without install scripts. The package reached 2 million weekly downloads; nine related packages were found and removed from npm.

• indexed-btree mimics sorted-btree, has 2M weekly downloads
• Loader hidden in BTree.prototype.set(), bypasses npm v12 checks
• Malware collects system data and sends it via Slack and Telegram
• C2 commands read from an Ethereum smart contract on Sepolia