Why Does an NPM Math Library Need an Encrypted Loader?
2 hours ago
- A malicious npm package named [email protected] was found to contain an encrypted remote access implant hidden inside a copy of the popular mathjs library.
- The malicious code remains dormant until the solver function is called with a specific matrix (a 3x3 Pascal matrix), which acts as a decryption key.
- The loader decrypts and executes a payload that takes commands from an attacker, using public services like Slack, Telegram, and a blockchain network for command and control.
- The same loader was found in two other npm packages: mathsbase and math-universe, across five versions, indicating a coordinated supply-chain attack.
- The loader and encrypted payloads were not present in the public GitHub source code, suggesting the malicious code was added during the npm publishing process.
- The decrypted payload includes a first-stage script that collects host data, generates cryptographic keys, reads a smart contract, and communicates with Slack and Telegram.
- A second-stage component (fraction.js) acts as a command agent, polling Slack for commands from the operator and executing them as shell commands.
- The attack requires a separate trigger: a caller must supply the specific matrix to the solver, but no public code was found that does this, suggesting it may be used in private or compromised projects.
- Indicators of compromise include specific package hashes, file hashes, base64 blobs, and command-and-control endpoints such as smart contract addresses and bot tokens.
- The investigation timeline shows the attacker published versions with the loader between August and September 2026, with downloads reported in the hundreds of thousands, though real installs remain uncertain.