- Sources: primary, discussion
- Summary: SafeDep reports five versions across the packages
mathmain, mathsbase, and math-universe carrying an encrypted loader whose key is never present in the registry copy, and enumerates the exact affected versions with archive SHA-256 hashes in an indicators-of-compromise table, which could not be read from this environment because the fetch path renders package-and-version pairs as placeholders. The key is one specific derived value, the JSON form of the LU lower factor, which more than one caller input produces, and SafeDep states the Pascal matrix is not the only trigger. Decrypted, the payload is a remote access implant that polls Slack conversations.history every 10 seconds and runs operator messages as shell commands on the host through execSync or spawn, with a bundled ethers copy reading a Base Sepolia contract and reporting to Slack and api.telegram.org. SafeDep reports download totals of 605,157 for mathmain, 1,923,059 for mathsbase, and 569,730 for math-universe between 2026-09-12 and 2026-09-18, but also states that npm reported zero downloads registry-wide for 2026-09-17, that the packages have no public dependents and almost no jsDelivr traffic, and that no caller of the trigger was found in public code. This report and the Checkmarx report on indexed-btree in Top stories, both published on 2026-09-21, describe near-identical mechanics, hardcoded Slack and Telegram channels, an Ethereum testnet contract polled for command and control, an X25519 exchange deriving an AES key, and the trigger placed in ordinary runtime library behaviour rather than an install script, though neither report claims a shared actor. - Why it matters: The registry copy never contains the decryption key, so neither static scanning nor SafeDep's own brute force, 16,922 candidate passwords against the filename blob and 533 against all five blobs, reached the payload until JFrog supplied the trigger input, and the loader is absent from the GitHub repositories the packages link, so the mechanism is confirmed while the exposure is not.
- Follow-up: Whether any real dependent is found that calls the trigger, which is what would turn this from a technique into an incident.
send feedback on this story