Malicious indexed-btree npm Package Runtime Loader Hook

Ibrahim Saud@tektrix

•updated Sep 21, 2026•1•0•3

Detects the presence of the malicious 'indexed-btree' npm package, which contains a backdoor that hooks 'BTree.prototype.set' to execute 'sharedLoad.min.js' at runtime. The rule monitors for characteristic file paths, function hooking patterns, and node process spawning behavior designed to evade installation-time static analysis.