MAL-2026-6193 Malicious code in ordered-btree (npm)

Package impersonates the legitimate sorted-btree library (matching name, README, and attributed author) and ships a hidden remote-code-execution payload in its primary API. b+tree.js modifies BTree.prototype.set so that when a caller invokes tree.set(100,…), it spawns node extended/diffLoad.min.js as a detached process. diffLoad.min.js is a heavily obfuscated loader that connects to Ethereum Sepolia (via hardcoded Infura/Alchemy RPCs), reads encrypted payload chunks from contract 0xE390863Dac96a71187C71227C2b099B50cF602D31 (TData1/TData2 events), decrypts them with x25519 ECDH + AES-GCM, writes the decrypted bytes to extended/merged, chmods to 755, and executes that file as a detached child process — using a public blockchain as rotatable, blocklist-evading C2. The loader also harvests host telemetry (platform, release, arch, hostname, cpus, totalmem, freemem, uptime) and exfiltrates it to a hardcoded attacker Telegram bot (bot id 8961878831 at api.telegram.org/bot<redacted>/sendMessage) and to slack.com/api/chat.postMessage with hardcoded credentials, including a message derived from the LICENSE file. After execution, it removes its own files (diffLoad.min.js, extended/bulkLoad.min.d.js, extended/diffLoad.d.min.js) and rewrites b+tree.js to splice out the 16-line trigger block starting at line 249, then signals the parent process (SIGTERM/taskkill) — anti-forensic clean-up so the installed package looks benign after the payload has run. Any application that drop-in-replaces sorted-btree with ordered-btree and exercises set with key 100 (e.g., tests, fixtures, or production data containing that key) will fetch and execute attacker-controlled code on the installer's machine.