Something’s off.A reported npm supply-chain attack may have avoided a safeguard aimed at suspicious installation scripts by putting its trigger inside an ordinary function of a look-alike library instead.
The package, called indexed-btree, reportedly ran its hidden loader only when an application used a particular value with a commonly used B-tree function. That means installation could appear clean, while the code would activate later during normal use.
The report says the package impersonated the legitimate sorted-btree library and accumulated about 2 million weekly downloads. It also alleges that the later-stage code collected system details, obtained further instructions through an Ethereum test-network contract, and could erase traces when the operators ended the operation.
UNVERIFIED
Feed metadata identifies a report, not independently verified underlying facts.
This is a source-attributed report whose underlying claims have not been independently verified.
