A malicious npm package reached over 2 million weekly downloads by hiding its payload in a routine library function rather than an install script.

The software supply chain has long been regarded as one of the most vulnerable attack surfaces in modern cybersecurity, and recent discoveries highlight just how innovative malicious actors have become in bypassing standard defenses. Security researchers at Checkmarx have uncovered a sophisticated, large-scale supply chain attack targeting the Node Package Manager (npm) ecosystem. The campaign successfully manipulated a series of widely utilized libraries, amassing over two million combined weekly downloads. Rather than relying on traditional installation scripts—which have faced increasing scrutiny and automated blocking by repository administrators—the threat actors embedded their malicious payload directly into routine runtime functions. This method of evasion allowed the compromised libraries to sit undetected in production environments, feeding malicious instructions to thousands of downstream applications while maintaining an illusion of complete operational legitimacy.

The Evolution of npm Supply Chain Attacks and Defensive Hurdles

To fully understand the gravity of this campaign, it is necessary to examine the evolving threat landscape of open-source software repositories. In recent years, threat actors have increasingly targeted package managers like npm, PyPI, and RubyGems to distribute malware. Developers heavily rely on open-source dependencies to accelerate software development, often incorporating dozens or hundreds of third-party modules into a single enterprise application. This deep dependency tree creates a massive blind spot; developers rarely audit every line of code inside every installed package, assuming that popular libraries are safe.

Historically, attackers executed malicious payloads during the installation phase by abusing lifecycle hooks defined in the package.json file, such as preinstall or postinstall scripts. These scripts execute automatically on a developer’s machine or CI/CD pipeline the moment the package is downloaded via npm install. Recognizing this vector as a primary hazard, GitHub and npm introduced tighter controls around automatic install script execution, effectively hobbling many traditional supply chain attacks that relied on installation-time execution hooks.

Faced with these new defensive measures, sophisticated threat actors were forced to adapt. Instead of executing code when a package is installed, the perpetrators behind this latest campaign devised a method that delays execution until the application is actively running in a live environment. By hiding their payload inside a deeply nested runtime function, the attackers rendered static installation scanners largely ineffective. The package could pass automated vulnerability assessments and installation checks without raising a single red flag, only to unleash its malicious behavior during standard runtime execution when specific, routine operational triggers were met.

Anatomy of the Attack: Blockchain C2 and Runtime Evasion

The technical execution of this campaign demonstrates a high degree of engineering sophistication. The core malicious logic was embedded directly into a runtime method known as BTree.prototype.set, residing within core data structure libraries rather than isolated installation hooks. When an application utilizing the compromised package invokes this specific method and passes a particular key value, the underlying code initiates a covert sequence of events.

Upon receiving the trigger value, the function launches an obfuscated first-stage loader as a detached Node.js background process. Because this process runs asynchronously and independently of the main application thread, it minimizes performance impact and avoids throwing visible application errors that might alert developers or system administrators.

Once successfully launched, the first-stage loader immediately begins fingerprinting the host environment. It systematically harvests critical system telemetry, including the operating system architecture, hostname, underlying CPU specifications, available system memory, and system uptime. This reconnaissance data is then exfiltrated to the attackers using hardcoded communication channels, specifically leveraging Slack channels and Telegram chats. Utilizing standard, legitimate communication platforms for data exfiltration allows the traffic to blend seamlessly with normal corporate network activity, often bypassing egress filtering rules that block unfamiliar or suspicious IP addresses.

Perhaps the most innovative aspect of this campaign is its command-and-control (C2) infrastructure. Rather than relying on traditional hardcoded domain names or IP addresses—which can be swiftly flagged, blocklisted, or seized by law enforcement and security vendors—the attackers utilized a smart contract deployed on the Sepolia Ethereum testnet blockchain.

According to Checkmarx researchers, the malicious smart contract exposes specific getter and setter functions. The malware periodically polls these blockchain functions instead of requesting a traditional web domain or static server address. This decentralized approach offers remarkable resilience against infrastructure takedowns. If a specific server hosting the secondary payload or collecting telemetry is compromised or shut down by hosting providers, the operators simply update the smart contract pointer on the blockchain to direct the malware to a brand-new infrastructure address without requiring any code updates to the deployed packages.

Furthermore, the malware employs advanced cryptographic techniques to secure its operations. It creates dynamic cryptographic keys to establish a secure, shared secret with a public key retrieved directly from the blockchain smart contract. This shared secret is subsequently utilized to decrypt and unlock a second-stage payload extracted from two encrypted data chunks stored within the smart contract itself.

While public disclosures from Checkmarx did not explicitly detail the exact operational objective of the second-stage payload, researchers emphasized the malware’s self-cleaning capabilities. Once the operational objectives are completed or the environment is deemed secure from analysis, the malware executes self-removal routines. It systematically deletes the associated malware files from the disk and purges the trigger code from the main prototype function, effectively wiping away forensic artifacts and making post-incident investigation significantly more difficult for security teams.

Chronology and Scope: Nine Packages Broaden the Campaign

The breadth of this campaign became apparent only after exhaustive analysis by threat intelligence researchers. The primary vehicle for the initial discovery was a widely downloaded package, but subsequent hunting revealed a broader ecosystem of compromised libraries designed to maximize reach across different developer workflows.

Checkmarx identified a total of nine distinct npm packages linked directly to this malicious campaign. Following the disclosure, registry administrators swiftly removed all associated packages from the public npm repository to prevent further downloads. The identified packages included:

• ordered-kv-index
• btree-leaderboard
• priority-slot-queue
• btree-range-store
• btree-core
• btree-time-index
• btree-lru-cache
• neighbor-key-map
• sliding-score-window

The impact of these packages was substantial due to their functional utility. Many of these libraries were designed to handle efficient data sorting, indexing, and caching—common requirements in high-performance web applications and backend services. Consequently, several of these modules accumulated hundreds of thousands of downloads. Most notably, the package titled btree-core alone surpassed 1.9 million downloads, cementing the campaign’s massive footprint across the global software development community.

To maintain the illusion of legitimacy and evade suspicion from vigilant developers or automated repository moderation bots, the threat actors went to great lengths to construct convincing developer personas and project repositories. Checkmarx noted that the operators maintained an active GitHub repository featuring numerous legitimate-looking commits and updates. Crucially, the malicious payload was meticulously kept out of the public source code repository; the clean version was displayed publicly on GitHub, while the compromised, weaponized code was injected during the publishing process when uploading the package to the public npm registry. Additionally, the GitHub accounts associated with the campaign utilized AI-generated profile images to project an aura of authenticity and community engagement.

Broader Implications for Software Supply Chain Security

The discovery of this blockchain-backed, runtime-executed supply chain attack serves as a stark wake-up call for the cybersecurity industry and the broader open-source community. It demonstrates that basic repository hygiene and restrictions on installation scripts are no longer sufficient to guarantee the safety of third-party dependencies.

As threat actors continue to innovate, security analysts have pointed out several critical implications stemming from this incident:

1. The Limitations of Static Analysis: Traditional security tools that scan package.json files or look exclusively for suspicious installation scripts will fail to detect threats hidden within runtime prototype functions. Security vendors must evolve their scanning engines to perform deep semantic analysis of package source code, identifying anomalous behavior within standard library methods.

2. The Rise of Decentralized Infrastructure: The use of public blockchains and smart contracts as C2 pointers represents a dangerous evolutionary leap in malware design. Traditional threat intelligence feeds rely heavily on domain and IP reputation. When attackers pivot to immutable, decentralized ledgers, traditional takedown strategies become obsolete, requiring security teams to focus on behavioral monitoring and endpoint detection.

3. The Open-Source Trust Deficit: The sheer volume of downloads—exceeding two million weekly—highlights the systemic risk of transitive dependencies. Enterprise organizations often have little visibility into the nested libraries pulled in by primary project dependencies. A single compromised utility function can compromise millions of downstream environments simultaneously.

Industry Response and Recommendations for Security Teams

Following the public disclosure of the campaign, security operations centers and DevSecOps teams around the world scrambled to audit their dependency trees. Checkmarx released a comprehensive set of indicators of compromise (IOCs), including specific file hashes, known malicious package names, and behavioral signatures, empowering organizations to scan their internal codebases and CI/CD pipelines for residual traces of the malware.

Industry experts recommend that development teams adopt a multi-layered defense strategy to mitigate the risks associated with modern software supply chain attacks:

• Implement Software Bill of Materials (SBOM) generation to maintain complete, real-time visibility into all direct and transitive dependencies utilized within enterprise applications.
• Deploy runtime application self-protection (RASP) and advanced Endpoint Detection and Response (EDR) solutions capable of monitoring unexpected background processes spawned by runtime libraries.
• Exercise caution when integrating generic utility libraries, particularly those maintained by newly created developer accounts or repositories lacking long-term community standing.
• Conduct regular audits of internal application logic to detect unauthorized data exfiltration attempts, particularly traffic directed toward non-standard messaging platforms like Telegram or Slack from production servers.

As the investigation into this ongoing campaign develops, security researchers warn that similar techniques are likely to be adopted by other threat groups. Protecting the software supply chain will require continuous collaboration between repository administrators, security vendors, and the developer community to outpace adversaries who constantly adapt their methods to bypass existing security controls.