# Malicious ‘indexed-btree’ npm Package Hid Malware in Smart‑Contract Calls, Exposing Supply‑Chain Hole

*Tuesday, September 22, 2026 at 10:07 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-09-22T10:07:48.142Z (1h ago)
**Category**: cyber | **Region**: Global
**Importance**: 7/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/18550.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: A malicious npm package, indexed-btree, quietly logged millions of downloads while hiding its malware in runtime code that pulled encrypted payloads from a Sepolia smart contract, highlighting how JavaScript supply chains can be compromised through blockchain‑hosted instructions.

One of the JavaScript ecosystem’s strengths—easy reuse of open‑source code—has again become a major vulnerability. A malicious package on npm, the main registry for JavaScript modules, managed to rack up millions of downloads while hiding its malware in an unusually cunning way: inside runtime logic that called out to a blockchain smart contract.

The package, named indexed-btree, posed as a seemingly innocuous library. Unlike many previous malicious npm packages, it did not rely on suspicious install scripts or obvious obfuscation that could trigger static analysis. Instead, it skipped install hooks altogether and waited until runtime—the moment the code actually executes inside an application—to start its attack chain.

According to technical analysis cited by The Hacker News, when the code ran it used a technique dubbed EtherHiding to reach out to a smart contract on Ethereum’s Sepolia test network. The contract stored an encrypted next‑stage payload. By embedding the malicious content in blockchain transactions, the operators took advantage of the fact that security tools and defenders rarely monitor testnet contracts for malware distribution.

Once downloaded and decrypted, that payload could execute further actions on compromised systems. The specific capabilities of the final stage were not fully detailed in initial public reports, but the method alone is worrying: it shows attackers actively looking for infrastructure—like public blockchains—that is globally available, hard to censor and rarely scanned for hostile code.

For developers, the stakes are clear. Millions of downloads do not automatically mean millions of successful compromises, but they do mean that indexed-btree likely sat in the dependency trees of numerous projects, including in build systems and server‑side applications. Companies that rely on npm modules for web front‑ends, internal tools or customer‑facing services may now have to comb through logs and dependency lists to see where this package landed.

This is not just a headache for security teams; it is a governance problem for any business that treats open‑source dependencies as a black box. In many organizations, a single developer can add a package to a project with a one‑line change, pulling in transitive dependencies that no one has ever heard of. When one of those is malicious and uses decentralized infrastructure to hide its instructions, traditional perimeter defenses and basic code reviews struggle to keep up.

Strategically, the indexed-btree incident is another data point in the trend toward software supply‑chain attacks that exploit trust rather than technical vulnerabilities. It follows earlier waves of npm and PyPI compromises but adds a twist by using blockchain as a covert distribution channel. That raises the bar for defenders: it is not enough to scan code at install time or to flag known bad domains. Monitoring runtime behavior and unusual outbound connections—even to something as obscure‑seeming as a testnet smart contract—is becoming essential.

The immediate next steps for organizations will be to audit where indexed-btree was used, remove or replace it and look for anomalous behavior linked to affected systems. Longer term, security teams and registries will be debating how to better vet popular packages, whether to treat interactions with blockchain infrastructure as a higher‑risk signal and how to build guardrails so that a single npm install cannot silently connect production workloads to an attacker’s smart contract halfway around the world.