The Hidden Trigger in a Dependency
A 17 September 2026 analysis found indexed-btree on npm impersonating sorted-btree. A BTree.prototype.set call matching key 100 activates concealed code without installation hooks.
Host data leaves through Telegram alongside Slack. Ethereum contract polling avoids dependence on one web address. The researchers cite around two million weekly downloads, leaving the affected population unclear. Downloads measure reach, not proven infections. A wallet reportedly held 109 ETH; that does not establish theft through this campaign.
Installation checks remain useful. Dependencies can activate on import, in tests or conditionally during use.
Extend the checkpoint
- Check exact package spelling; imitation names disguise origin.
- Pin changes; require accountable approval of direct and transitive dependencies.
- Watch unexpected connections, child processes and secret access in builds and applications.
- Constrain build credentials across publishing, cloud and repository authority.
- Search versions in branches, lockfiles, caches, containers and shipped artefacts.
- After execution with readable secrets, remove the dependency, retain evidence and revoke reachable credentials.
Quiet setup never proves safe execution.
Follow-up: 20 September 2026, 10:11 displayed; timezone unspecified.
