indexed-btree@2.1.2

Analysis

indexed-btree@2.1.2 is a trojanized clone of a B+ tree library. The legitimate B+ tree code in b+tree.js is used as camouflage while the malicious payload in extended/sharedLoad.min.js and extended/sharedLoad.d.min.js (584KB) runs at require() time. The payload collects system information (hostname, platform, CPU count, memory, uptime) and exfiltrates it via multiple C2 channels: (1) Telegram — posts system report to a Telegram chat via a hardcoded bot token; (2) Slack — posts system report to a Slack channel via two different hardcoded bot tokens; (3) Ethereum blockchain — connects to Sepolia testnet via Infura and Alchemy with hardcoded API keys, making eth_call to a specific contract address for on-chain operations. The payload also contains ECDH key exchange and AES-GCM encrypted communication capabilities, a full embedded ethers.js-style Ethereum provider, and self-modifies the installation files at runtime.