ordered-btree@3.2.2

Analysis

ordered-btree@3.2.2 is a trojanized version of the legitimate B+ tree library. When a user calls set(100, ...) on a BTree instance, the package spawns a detached node process that runs a multi-stage implant. The implant uses X25519 key exchange and AES-GCM decryption to retrieve commands from a Sepolia testnet smart contract at address 0xe390863dac96a7118c71227c2b099b50cf602d31 via Infura and Alchemy RPC endpoints using hardcoded API credentials. It collects system fingerprint information (hostname, platform, architecture, CPU count, memory, uptime) and exfiltrates it to Slack via slack[.]com/api/chat.postMessage (using a hardcoded Slack bot token) and to Telegram via api[.]telegram[.]org (using a hardcoded Telegram bot token). The implant then decrypts a second-stage payload from the smart contract and executes it as a new detached process. After execution, the implant deletes its own source files (diffLoad.min.js and diffLoad.d.min.js) and modifies b+tree.js. The C2 infrastructure uses the Sepolia testnet as a blockchain-based command channel with on-chain encrypted command storage and retrieval via eth_call RPC.