Checkmarx says the malicious npm package indexed-btree, uploaded by the user charlessadler25 on June 18, 2026, mimicked the legit sorted-btree library and gathered millions of downloads before it was removed after disclosure. The package is now gone from npm along with its GitHub repository.
Its loader lived in ordinary application code, in a BTree.prototype.set() method, rather than in preinstall or postinstall scripts. That matters because a package can look clean at install time and still run malicious code later when the application actually calls the library, so install-hook defenses and lifecycle-script checks never get a chance to flag it.
The exposure sits in the runtime path, which means developer workstations, CI builds, and shipped artifacts can all inherit the same blind spot if they trusted install-time scanning alone. That keeps the risk alive anywhere a malicious dependency can be imported and executed after installation.
Malicious npm packages evade install-script defenses at runtime
An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by hiding malicious code in a package's normal runtime behavior rather than in installation scripts.