Malicious npm Package 'indexed-btree' Racks Up Millions of Downloads

A malicious npm package named “indexed-btree” has accumulated millions of downloads while posing as the legitimate “sorted-btree” package, an ordinary B-tree/indexing utility.

Rather than relying on npm lifecycle scripts, the package hides its malware trigger inside a prototype method in application runtime code. Researchers say this reflects a shift in attacker tactics in response to recent supply-chain security controls that specifically target lifecycle scripts.