npm ‘btree’ Malware Campaign Affects Millions of Downloads, No Need for Install Script

This report details an ongoing, sophisticated npm supply-chain campaign where a malicious package (indexed-btree) hides a runtime loader in a BTree.prototype.set override to fetch a second-stage payload via an on-chain Sepolia smart contract (using X25519/ECDH and AES), exfiltrates host data to Telegram and Slack, includes cleanup routines, has achieved large-scale distribution, and provides multiple IOCs (package names, contract address, bot tokens, channel/chat IDs, and a hardcoded public key).