npm indexed-btree malware polling Sepolia Ethereum C2 contract

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•4

Detects network traffic from internal hosts interacting with Ethereum Sepolia testnet contracts via common blockchain infrastructure providers (Alchemy, Infura) or JSON-RPC calls. These patterns are characteristic of 'indexed-btree' malware utilizing decentralized blockchain technology for command-and-control polling.