Malicious npm Library ‘indexed-btree’ Masquerades as Legitimate Tool, Racking Up Nearly 2 Million Weekly Downloads

Security researchers have uncovered a rogue package on the Node.js package registry that pretended to be a standard data‑indexing module, exposing a gap in today’s software supply‑chain defenses.

The package, named indexed-btree, copied the name and description of the legitimate sorted-btree library. By mimicking the authentic project’s metadata, it attracted developers who depend on npm’s vast ecosystem, eventually recording close to two million downloads per week.

Analysis of the package’s source code revealed that the malicious payload was not present in the published files but was injected at runtime. When the module was executed, it fetched additional code from an external server and executed it on the host machine, giving the attacker the ability to run arbitrary commands. This “download‑and‑execute” technique bypasses many static‑analysis tools that only inspect the code shipped in the registry.

The incident highlights a recurring challenge for open‑source ecosystems: the reliance on trust in package metadata and the difficulty of verifying the integrity of every published version. Similar supply‑chain attacks, such as the 2018 compromise of the event-stream module and the 2021 hijack of the ua-parser-js package, have shown that popular libraries can become vectors for malware when attackers gain publishing rights.

npm’s maintainers responded by removing the offending version of indexed-btree and issuing a notice to the community. They also reminded developers to employ tools like npm’s audit feature, lockfile verification, and third‑party security scanners that can detect anomalous behavior such as unexpected network calls at runtime.

Experts say the episode underscores the need for stronger provenance checks and automated verification of package behavior before integration into production systems. As the JavaScript ecosystem continues to grow, organizations are urged to adopt a layered defense strategy that includes regular dependency reviews, reproducible builds, and monitoring for suspicious network activity originating from third‑party code.