Malicious npm Package 'indexed-btree' Runtime Evasion Campaign

Technical Analysis

The 'indexed-btree' package embeds malicious logic within standard runtime functions instead of preinstall/postinstall scripts, the traditional vector monitored by npm security tools like Socket, Snyk, and npm's own audit mechanisms. By deferring execution to runtime, the payload activates only when specific functions are called during normal application use, evading static and dynamic install-time analysis. This technique suggests threat actors are adapting to improved install-script monitoring by shifting the trigger point deeper into the dependency execution lifecycle, potentially enabling credential theft, data exfiltration, or backdoor installation once the package is integrated into a build. Organizations running AI agent frameworks, RAG pipelines, or LLM tool-use systems that programmatically install npm dependencies (including autonomous coding agents or CI/CD-integrated agents) are at elevated risk, since such systems may pull and execute untrusted packages with less human review, potentially exposing API keys, model credentials, or internal data through the compromised runtime code path.

Affected Systems

Node.js applications and services that have installed the 'indexed-btree' npm package or its dependents; CI/CD pipelines, build systems, and developer environments using npm/yarn/pnpm without strict dependency pinning or runtime behavior monitoring

Indicators of Compromise

• Package name: indexed-btree (npm registry)
• Associated malicious npm packages from the same campaign (names not fully disclosed in source)
• Suspicious runtime network calls originating from Node.js processes post-install

Remediation Steps

1. 1

   Remove and audit affected package

   Immediately uninstall 'indexed-btree' and any transitive dependencies from affected projects; audit package-lock.json/yarn.lock for the package hash and remove all instances.

2. 2

   Runtime behavior monitoring

   Deploy runtime application self-protection (RASP) or behavioral monitoring tools that detect anomalous outbound network calls or file system access from Node.js dependencies, not just install-time hooks.

3. 3

   Dependency pinning and lockfile integrity

   Enforce strict version pinning, use lockfile integrity checks, and adopt tools like npm's provenance attestation to verify package origin and build integrity.

4. 4

   Audit CI/CD and agent-driven installs

   Review CI/CD pipelines and any autonomous coding/AI agents that install npm packages programmatically; restrict auto-install permissions and require human-in-the-loop approval for new dependencies.

5. 5

   Rotate exposed credentials

   If the package was installed in any environment with access to API keys, cloud credentials, or secrets, rotate those credentials immediately as a precaution.