MAL-2026-6063

Dashboard / Malicious Package / MAL-2026-6063

MAL-2026-6063

Summary: Malicious code in sort-btree (npm)

Details: Source: amazon-inspector (c21e3fbfbd2c75d226e7f427d760d771d29d6f612eaaa98b5b6daed7bc164035) Pattern matches fired on minified files extended/b+tree.min.js and extended/bulkLoad.min.d.js based on keyword co-occurrence (require("child_process"), GET/POST tokens, and the word 'hostname') within single-line minified output. The package presents itself as a B+ tree data structure library, where these tokens may correspond to benign symbol names or unrelated code paths in minified output rather than an exfiltration channel. No traced execution path confirms outbound network activity, environment scraping, lifecycle-hook execution, or attacker-controlled destinations. There is no hardcoded C2 endpoint, no install/lifecycle script, and no credential-path access visible in the available evidence. Routing to human review so a reviewer can de-minify the bundle and confirm whether the child_process and HTTP-related tokens reflect actual runtime behavior or merely incidental keyword proximity in compressed output. Source: ghsa-malware (6c3b0d783c53decf1a240f02276991c7c00a8b72f0d3988a7e86be90464da38d) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References: https://github.com/advisories/GHSA-wwvg-mj5j-mqx8, https://www.npmjs.com/package/sort-btree/v/2.1.6, https://www.npmjs.com/package/sort-btree/v/2.2.0