Malware Hides in Normal Code to Bypass Security Checks

A new malware campaign is targeting developers by exploiting a blind spot in current supply chain security measures. The attack involves a package named 'indexed-btree' that mimics a legitimate library, allowing it to gather millions of downloads without triggering standard installation alerts. Because the malicious code is embedded in the normal operation of the software rather than its setup phase, it slips past the automated blockers designed to catch such threats.

Research from Checkmarx, reported by BleepingComputer, reveals that this method allows attackers to bypass the recent security updates introduced by GitHub. These updates typically block suspicious installation scripts, but this malware avoids those scripts entirely. Instead, it waits for the application to run, activating only when specific functions are called, which makes it invisible to static scanning tools that analyze code before execution.

Evading standard security defenses

The technical trick relies on placing the malware loader inside a common method used by the library to manage data. Since this method is part of the package's normal behavior, it does not raise red flags during the installation process. This approach effectively neutralizes the protective measures that prevent unapproved scripts from running, allowing the malicious payload to load silently in the background of the application.

Once active, the malware collects detailed system information such as hardware specifications and network details. It then sends this data to external communication channels controlled by the attackers. The code also connects to a blockchain-based command and control channel to receive further instructions, demonstrating a high level of sophistication in how the threat is managed remotely.

Financial gains and cleanup capabilities

The attackers have shown no sign of stopping, with a linked cryptocurrency wallet holding over 109 ETH. While the exact source of these funds is not confirmed as stolen cryptocurrency, the volume suggests significant illicit activity. The malware is also designed for stealth, capable of deleting its own files and removing its trigger code from the package to erase traces of the intrusion once the attack is complete.

To appear legitimate, the creators built a convincing online presence for the project, including a populated commit history and a curated developer profile. This effort to mimic a real open-source project helped the package gain trust and distribution. Checkmarx identified nine other packages linked to this operation, all of which have been removed from the registry after accumulating hundreds of thousands of downloads each.

Risks for developers and users

This incident highlights a critical gap in how developers secure their software. Relying solely on scanning tools that check code during installation is no longer sufficient against sophisticated supply chain attacks. Organizations need to implement runtime behavioral analysis to detect malicious activity that occurs after the software is installed and running.

Developers who have installed the 'indexed-btree' package or any of the related libraries are at risk. The recommended course of action is to rotate all security credentials and restore their development environments from known safe backups. This incident serves as a reminder that supply chain security requires continuous monitoring and a multi-layered defense strategy.