Which versions of ordered-btree are malicious?

The following npm versions of ordered-btree are flagged malicious: 3.2.2. Treat any of these as compromised.

How do I remediate ordered-btree if I installed it?

ordered-btree is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed ordered-btree — how do I know if it already compromised me?

If ordered-btree was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is ordered-btree part of a known attack campaign?

Yes — ordered-btree is associated with the IN-MAL-2026-007055 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find ordered-btree across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for ordered-btree (version 3.2.2).

Malicious package

ordered-btreenpm

Advisory published Jun 19, 2026Updated Jun 19, 2026

ordered-btree is a confirmed malicious npm package (MAL-2026-6193) that steals credentials and exfiltrates sensitive data (malicious version 3.2.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in ordered-btree (npm)

MAL-2026-6193

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall ordered-btree

What this malware does

Package impersonates the legitimate sorted-btree library (matching name, README, and attributed author) and ships a hidden remote-code-execution payload in its primary API. b+tree.js modifies BTree.prototype.set so that when a caller invokes tree.set(100,...), it spawns node extended/diffLoad.min.js as a detached process. diffLoad.min.js is a heavily obfuscated loader that connects to Ethereum Sepolia (via hardcoded Infura/Alchemy RPCs), reads encrypted payload chunks from contract 0xE390863Dac96a71187C71227C2b099B50cF602D31 (TData1/TData2 events), decrypts them with x25519 ECDH + AES-GCM, writes the decrypted bytes to extended/merged, chmods to 755, and executes that file as a detached child process — using a public blockchain as rotatable, blocklist-evading C2. The loader also harvests host telemetry (platform, release, arch, hostname, cpus, totalmem, freemem, uptime) and exfiltrates it to a hardcoded attacker Telegram bot (bot id 8961878831 at api.telegram.org/bot<redacted>/sendMessage) and to slack.com/api/chat.postMessage with hardcoded credentials, including a message derived from the LICENSE file. After execution, it removes its own files (diffLoad.min.js, extended/bulkLoad.min.d.js, extended/diffLoad.d.min.js) and rewrites b+tree.js to splice out the 16-line trigger block starting at line 249, then signals the parent process (SIGTERM/taskkill) — anti-forensic clean-up so the installed package looks benign after the payload has run. Any application that drop-in-replaces sorted-btree with ordered-btree and exercises set with key 100 (e.g., tests, fixtures, or production data containing that key) will fetch and execute attacker-controlled code on the installer's machine.

Malicious versions

1 flagged

3.2.2

Indicators of compromise (SHA-256)

3a7b579313f4d78d1b99c88ed3fc22c295458981099a80f09f8408ca2bbb2ac4

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for ordered-btree (version 3.2.2).
If you installed it — respond
ordered-btree is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If ordered-btree was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. ordered-btree on npm has been identified as a malicious package (version 3.2.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-007055

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks ordered-btree-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database