sort-btree @2.2.0

Summary

Pattern matches fired on minified files extended/b+tree.min.js and extended/bulkLoad.min.d.js based on keyword co-occurrence (require("child_process"), GET/POST tokens, and the word 'hostname') within single-line minified output. The package presents itself as a B+ tree data structure library, where these tokens may correspond to benign symbol names or unrelated code paths in minified output rather than an exfiltration channel. No traced execution path confirms outbound network activity, environment scraping, lifecycle-hook execution, or attacker-controlled destinations. There is no hardcoded C2 endpoint, no install/lifecycle script, and no credential-path access visible in the available evidence. Routing to human review so a reviewer can de-minify the bundle and confirm whether the child_process and HTTP-related tokens reflect actual runtime behavior or merely incidental keyword proximity in compressed output.

Source: amazon-inspector (c21e3fbfbd2c75d226e7f427d760d771d29d6f612eaaa98b5b6daed7bc164035)