Which versions of ordered-btree are malicious?

The following npm versions of ordered-btree are flagged malicious: 3.2.2. Treat any of these as compromised.

How do I remediate ordered-btree if I installed it?

ordered-btree is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed ordered-btree — how do I know if it already compromised me?

If ordered-btree was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is ordered-btree part of a known attack campaign?

Yes — ordered-btree is associated with the IN-MAL-2026-007055 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find ordered-btree across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for ordered-btree (version 3.2.2). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging ordered-btree across your stack and pipelines.

Malicious package

ordered-btreenpm

ordered-btree is a confirmed malicious npm package (MAL-2026-6193) that steals credentials and exfiltrates sensitive data (malicious version 3.2.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in ordered-btree (npm)

MAL-2026-6193

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall ordered-btree

What this malware does

Package impersonates the legitimate sorted-btree library (matching name, README, and attributed author) and ships a hidden remote-code-execution payload in its primary API. b+tree.js modifies BTree.prototype.set so that when a caller invokes tree.set(100,...), it spawns node extended/diffLoad.min.js as a detached process. diffLoad.min.js is a heavily obfuscated loader that connects to Ethereum Sepolia (via hardcoded Infura/Alchemy RPCs), reads encrypted payload chunks from contract 0xE390863Dac96a71187C71227C2b099B50cF602D31 (TData1/TData2 events), decrypts them with x25519 ECDH + AES-GCM, writes the decrypted bytes to extended/merged, chmods to 755, and executes that file as a detached child process — using a public blockchain as rotatable, blocklist-evading C2. The loader also harvests host telemetry (platform, release, arch, hostname, cpus, totalmem, freemem, uptime) and exfiltrates it to a hardcoded attacker Telegram bot (bot id 8961878831 at api.telegram.org/bot<redacted>/sendMessage) and to slack.com/api/chat.postMessage with hardcoded credentials, including a message derived from the LICENSE file. After execution, it removes its own files (diffLoad.min.js, extended/bulkLoad.min.d.js, extended/diffLoad.d.min.js) and rewrites b+tree.js to splice out the 16-line trigger block starting at line 249, then signals the parent process (SIGTERM/taskkill) — anti-forensic clean-up so the installed package looks benign after the payload has run. Any application that drop-in-replaces sorted-btree with ordered-btree and exercises set with key 100 (e.g., tests, fixtures, or production data containing that key) will fetch and execute attacker-controlled code on the installer's machine.

Malicious versions

1 flagged

3.2.2

Indicators of compromise (SHA-256)

3a7b579313f4d78d1b99c88ed3fc22c295458981099a80f09f8408ca2bbb2ac4

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for ordered-btree (version 3.2.2). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging ordered-btree across your stack and pipelines.
If you installed it — respond
ordered-btree is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If ordered-btree was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks ordered-btree before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. ordered-btree on npm has been identified as a malicious package (version 3.2.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-007055

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks ordered-btree-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database