The security landscape for Node.js developers shifted significantly in June 2026 with the introduction of npm v12, which disabled dependency lifecycle scripts by default. This “secure-by-default” posture was designed to kill off “Shai-Hulud” style worms and automated installation-time attacks.
Security researchers at Checkmarx identified a cluster of malicious packages in which the malicious trigger is hidden within the BTree.prototype.set() method. Rather than relying on the preinstall or postinstall hooks that npm v12 now blocks, the malware is embedded directly into the library’s functional code.
The malware executes when the host application calls the library’s functions to manage data. Because the payload resides in a core method like .set(), execution occurs during the normal course of application activity.
Sophisticated C2 and Data Exfiltration
The campaign exhibits a high level of operational maturity, utilizing decentralized infrastructure to manage its command-and-control (C2) operations. According to Checkmarx, the malware uses an Ethereum smart contract as a resilient C2 mechanism. This approach ensures that the infrastructure cannot be easily taken down by traditional domain-name seizures.
Once the malware is triggered at runtime, it exfiltrates harvested data through common communication platforms, specifically Slack and Telegram. This method allows the malicious traffic to blend in with legitimate developer activity, as many enterprise environments already allow outbound traffic to these services.
The financial scale associated with the attackers suggests a well-funded operation. A linked Ethereum wallet identified during the investigation holds approximately 109 ETH. While the direct source of these funds has not been confirmed, the presence of significant digital assets points to a high-value campaign rather than a low-level experiment.
Beyond the Install-Script Defense
For several years, the standard advice for securing the software supply chain was to disable or strictly monitor installation scripts. The npm v12 update was the culmination of that effort, effectively closing the “front door” for most automated attacks. However, the runtime execution of the code itself remains a vector for malicious activity.
When malicious code is injected into prototypes or core library methods, traditional static analysis that looks for suspicious shell commands in package.json will fail to flag the threat. This evolution necessitates a shift toward more granular runtime monitoring and the use of software composition analysis (SCA) tools that can inspect the actual logic of the functions being imported, rather than just the installation metadata.
