Malicious npm 'indexed-btree' typosquat campaign package names

Ibrahim Saud@tektrix

•updated Sep 21, 2026•2•0•12

Detects the presence of package.json or node_modules artifacts associated with a known typosquatting campaign targeting the 'sorted-btree' npm package. The rule identifies suspicious package names or dependencies by matching against a list of known malicious packages used in the campaign, or by detecting the co-occurrence of the malicious 'indexed-btree' package alongside the legitimate 'sorted-btree' package.