indexed-btree is a malicious npm package that impersonates the legitimate sorted-btree library and reportedly reached nearly 2 million weekly downloads, according to Checkmarx. Malicious code executes during normal module load/use (no preinstall/postinstall required), enabling compromise in Node.js apps and CI. Any project that adds or bundles the package can be affected. Remove indexed-btree, audit dependency trees/lockfiles, and rotate exposed secrets.