npm indexed-btree malware exfil via hardcoded Slack bot token/channel

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•7

Detects HTTP and TLS traffic patterns indicative of data exfiltration to Slack, specifically targeting hardcoded Slack API tokens, Slack channel IDs in HTTP request bodies, or traffic directed to hooks.slack.com, commonly associated with malicious npm packages.