Beyond Install Scripts: How the "indexed-btree" npm Campaign Leverages Runtime Execution and Blockchain C2 to Evade Defenses
Author: DigitalSpying Security Desk
Date: September 20, 2026
Category: Software Supply Chain Security / Web Application Defense / Open Source Threat Intelligence
Executive Summary
The open-source software supply chain has crossed a sophisticated new threshold. For years, cybersecurity guidelines, package scanners, and enterprise security policies have advised developers to mitigate npm malware by neutralizing installation lifecycle scripts—chiefly by passing the --ignore-scripts flag during builds or relying on static scanners that flag suspicious preinstall and postinstall entries in package.json. However, an ongoing software supply-chain campaign centered on the malicious package indexed-btree proves that threat actors have adapted to bypass build-time defenses entirely.
As reported by BleepingComputer and detailed by Checkmarx Zero Research, the operators behind indexed-btree deliberately omitted all lifecycle install hooks. Instead, the package acts as a fully functional, legitimate B-tree indexing library that compiles and installs cleanly without triggering a single build-time warning. The malicious payload remains completely dormant until runtime, activating only when the hosting application imports the module and executes standard data-query methods. Furthermore, the campaign introduces an uncensorable Command-and-Control (C2) mechanism: rather than hardcoding static domain names or querying dynamic DNS servers, the malware queries decentralized smart contracts deployed across public blockchains (Ethereum and BNB Chain) to dynamically resolve active C2 IP addresses and cryptographic keys.
Deep-Dive Technical Analysis
1. The Death of the "Install-Time" Assumption
Historically, over 95% of malicious packages detected on the npm registry rely on package lifecycle hooks (package.json -> "scripts": {"postinstall": "node setup.js"}). This historical pattern created an industry-wide blind spot:
* The False Sense of Security with --ignore-scripts: Security-conscious development teams configured CI/CD pipelines and developer .npmrc files to automatically enforce ignore-scripts=true.
* Static Scanner Limitations: Software Composition Analysis (SCA) tools and security linters heavily weight the presence of install scripts, network calls during installation, and obvious obfuscation in root files.
* The Trojanized Utility Mask: The author of indexed-btree provided a fully working, highly performant implementation of an in-memory B-tree data structure. Benchmark tests and unit tests passed flawlessly, making the package appear legitimate to developers and automated auditors alike.
2. The Runtime Trigger Mechanism
Because no install scripts exist, npm install indexed-btree --ignore-scripts completes with zero anomalies. The threat only materializes when the parent application boots into production:
* Triggering upon Library Invocation: The malicious code is embedded within internal traversal methods (e.g., BTree.prototype.search() or BTree.prototype.insert()).
* Execution Throttling & Anti-Sandbox Heuristics: To evade automated sandbox analysis in security registries, the malware checks:
1. Uptime & Call Frequency: It requires the application process to have been running for at least 15 minutes or to have performed at least 500 legitimate search operations before unleashing its payload.
2. Environment Profiling: It inspects process.env to ensure it is not running within known CI environments (GitHub Actions, GitLab CI, CircleCI).
* Payload Execution: Once the threshold is met, an unexported helper asynchronously spins up a worker thread or native Node.js subprocess that scrapes memory buffers, database connection pools, and cloud credentials (AWS_SECRET_ACCESS_KEY, STRIPE_KEY, JWT_SECRET).
Indexed-Btree Runtime Infection Chain
Phase
Description
Developer / CI/CD Pipeline
Executes: npm install indexed-btree --ignore-scripts
Clean Build Phase
Zero install scripts in package.json -> NO build-time alerts. Package successfully bundled into production server codebase.
Production Runtime
Application imports indexed-btree and performs normal B-Tree data operations. After 500 queries / 15 mins uptime, internal hook awakens payload.
Blockchain C2 Resolution
Queries public RPC node (Ethereum / BNB Chain) calling View function on Smart Contract. Extracts encrypted C2 IP address and public key stored on-chain.
Data Harvesting
Dumps process.env variables and runtime memory buffers. Intercepts application database transactions passing through B-Tree index.
Exfiltration
Transmits encrypted data to C2 endpoint via HTTPS POST / WebSocket.
3. The Uncensorable Blockchain C2 Network
The use of public blockchains for Command-and-Control infrastructure represents an escalating trend in threat actor resilience:
* The Smart Contract Resolver: Instead of reaching out to a domain name that registrars or security vendors can seize (via sinkholing or DNS blocklists), indexed-btree transmits JSON-RPC eth_call requests to public, legitimate Web3 gateway nodes (such as Cloudflare Ethereum Gateway, Infura, or Ankr).
* Immutable On-Chain Metadata: The malware interacts with a deployed smart contract, calling a read-only getter function. The smart contract decodes an on-chain storage variable containing hex-encoded IP addresses and rotating RSA/AES session keys.
* Immunity to Takedowns: Because transactions on public blockchains cannot be arbitrarily deleted or censored by security teams or law enforcement, the threat actors can update their backend C2 infrastructure at will simply by signing a new on-chain transaction from their private crypto wallet.
Industry Impact & The Failure of Perimeter Defenses
The indexed-btree incident provides a critical lesson for the modern software industry:
1. The Fallacy of Build-Time-Only Supply Chain Security: Hardening build pipelines against install-time execution is necessary, but wholly insufficient. Attackers recognize that malicious code executed inside production runtimes has direct access to live databases, active customer sessions, and unencrypted memory.
2. Web3 Gateways as Covert Channels: Legitimate blockchain JSON-RPC calls are rarely blocked by corporate firewalls, allowing threat actors to blend C2 resolution into standard web traffic.
3. Database & Data Structure Tampering: By compromising foundational data structure libraries (trees, maps, linked lists), adversaries gain vantage points capable of subverting application logic, manipulating financial calculations, and intercepting queries before database encryption occurs.
Recommendations & Mitigation Strategies
Engineering organizations, platform architects, and DevOps leads must shift their supply chain defense strategies from purely static inspection to active runtime behavioral enforcement.
1. Implement Runtime Application Self-Protection (RASP) & eBPF
* Process-Level Behavioral Monitoring: Deploy runtime security tooling (e.g., Datadog ASM, Dynatrace, or eBPF-based tools like Cilium Tetragon and Falco) that monitors Node.js runtime behavior. Configure policies to alert or terminate processes when an application dependency unexpectedly spawns child processes (child_process.exec), attempts raw socket connections to unknown IP addresses, or reads sensitive credential directories.
2. Enforce Strict Outbound Network Egress Filtering
* Default-Deny Container Egress: Backend database microservices and API engines should have zero unconstrained access to the public internet:
* Configure Kubernetes NetworkPolicies or cloud security groups to block all outbound egress traffic except to explicitly allowlisted payment gateways, internal databases, and authenticated third-party APIs.
* Specifically block outbound queries to public Web3/Ethereum RPC gateways (*.infura.io, *.ankr.com, cloudflare-eth.com) unless the enterprise explicitly operates a cryptocurrency service.
3. Deep AST Analysis & Dependency Sandboxing
* Behavioral Package Analysis: Utilize advanced package firewalls that execute Abstract Syntax Tree (AST) analysis to flag suspicious runtime behavior (such as hidden eval(), obfuscated character arrays, and dynamic require() calls) even when package install scripts are absent.
* Pin Exact Hashes and Maintain Internal Scoped Registries: Never permit direct, unreviewed ingestion of third-party public npm packages into production. Mirror and lock approved dependencies inside a secure private artifact repository (JFrog Artifactory, Sonatype Nexus) backed by code review.