Encrypted Remote Access Implant Discovered in Malicious NPM Math Libraries

Security researchers at SafeDep have uncovered an encrypted remote access implant hidden inside malicious packages published to the npm registry, as reported via Hacker News. The packages—including mathmain, mathsbase, and math-universe—were constructed to clone the popular open-source JavaScript mathematics library mathjs. Unlike conventional supply chain attacks that trigger install scripts or run upon being imported, this payload remains completely dormant until an application executes the library's linear solver with a specific mathematical input that doubles as its decryption key.

SafeDep initially identified the anomaly on September 17, 2026, during an analysis of mathmain version 1.0.1. A review of the package's CommonJS build revealed added code appended to the lusolve() linear solver function. Once lusolve() computes its normal result, it passes the lower triangular matrix factor to a function named removeSolveValidation(), which routes into isGraph(). That routine stringifies the matrix data into JSON format, using the string as a passphrase to attempt decrypting payload files.

The package loader employs Node.js cryptographic modules to process the encrypted components stored in its utility directories. Using scrypt, the loader derives a 256-bit key from the JSON string and attempts to decrypt base64-encoded files using AES-GCM. The encrypted payloads use a layout containing a 16-byte salt, a 12-byte initialization vector, and a 16-byte authentication tag ahead of the ciphertext. When caller inputs do not produce the expected matrix, the authentication check fails, leaving no decrypted files on disk.

Unlocking the payload required finding an equation whose LU decomposition yields an exact lower triangular factor L of [[1, 0, 0], [1, 1, 0], [1, 0.5, 1]]. Security firm JFrog first identified the required solver input, which SafeDep subsequently reproduced and verified against the malicious packages. SafeDep had previously tested nearly 17,000 potential password candidates and arrays without matching the authentication tag. Converting the correct matrix factor to JSON decrypted the payload files across both mathmain and math-universe.

The decrypted code forms a three-stage remote access implant running with the permissions of the host Node.js process. The initial stage, graph.js, collects host information via os and fs modules, generates X25519 key pairs, executes system commands using child_process, and loads later stages. The second file, bignumber/type.js, bundles version 5.7.2 of the ethers library to read smart contracts on Ethereum's Base Sepolia testnet. The third stage, fraction.js, acts as a command agent that verifies an environment variable named CHAT_PASSWORD, polls a Slack channel history endpoint every 10 seconds, runs operator instructions as shell commands, and posts results back to Slack and Telegram. Decrypted endpoints in both analyzed deployments shared an Alchemy project key (D2-TbkB2m05WXSnSDOCDI), linking the releases to a common operator.

The investigation also revealed deliberate evasive packaging. While mathsbase and math-universe referenced public GitHub repositories, the malicious modifications were absent from those repositories, showing that the loader was injected directly into the npm tarballs during publishing. Public searches across GitHub repositories and package dependencies revealed no public callers passing the trigger matrix, indicating the attacker may have targeted private environments or intended to supply the trigger through a separate component.