npm install of malicious indexed-btree campaign packages

Ibrahim Saud@tektrix

•updated Sep 21, 2026•3•0•7

This rule detects the execution of common Node.js package managers (npm, yarn, pnpm) attempting to install specific dependencies that match known patterns of malicious or typosquatted packages often used in supply chain attacks. The detection focuses on suspicious package names that mimic common data structure library naming conventions.