btree-order-book@1.0.1

Analysis

btree-order-book is a limit-order-book matching engine that depends on indexed-btree, a package previously identified as malicious. Installing btree-order-book transitively installs the known-malicious indexed-btree dependency. The package code itself is a straightforward TypeScript trading engine with no obfuscation or exfiltration, but its dependency chain introduces a supply-chain risk: any malicious behaviour in indexed-btree (postinstall payload, token theft, etc.) would execute in the context of the installer.