Malicious NPM Package 'indexed-btree' Accumulates Millions of Downloads, Exfiltrating System Information via Telegram
A malicious NPM package named 'indexed-btree' has accumulated millions of downloads, bypassing NPM's security measures by hiding its malicious code within the library's main function, specifically the `BTree.prototype.set` method. This method triggers JavaScript code that initiates the malware's first stage. Once executed, the malware collects system information and transmits it to a hardcoded Slack channel and a Telegram chat. It then connects to a blockchain contract deployed on Sepolia, which acts as its command-and-control (C&C) server, to extract and decrypt its second stage. The attacker behind this campaign reportedly made approximately 109 ETH (nearly $300,000). The malicious package mimics the legitimate 'sorted-btree' utility, and the threat actor built trust by creating a seemingly legitimate GitHub repository with numerous commits to avoid immediate detection.
