Malicious npm package 'mathmain' uses encrypted loader triggered by specific math equation

Discovery of the Implant

A remote access implant was identified within the npm package 'mathmain', which is a duplicate of the 'mathjs' library. The malicious component is encrypted and remains inactive until a specific equation is processed by the library. This equation functions as a decryption key.

Payload Execution and Command Channel

Upon solving the correct equation, the package decrypts and executes a payload. This payload is designed to receive commands from an attacker and execute them on the compromised host. It utilizes a public chat service and a blockchain network to establish its command and control channel.

Technical Details of the Loader

The loader was found during a SafeDep analysis of 'mathmain' on September 17, 2026. An added call within the 'lusolve()' function, specifically 'removeSolveValidation()', led to the discovery. This function, disguised as 'isGraph()', converts input data into a JSON string used as a password. It then decrypts a filename and loads the returned path.

The decryption process, located in 'lib/cjs/utils/event.js', uses 'scrypt' to generate a 256-bit key from the password, followed by AES-GCM for data decryption. The encrypted data includes a salt, initialization vector, and authentication tag, stored as base64 text. The password for calls through the solver is 'JSON.stringify(L._data)', requiring specific matrix data to trigger decryption.

Implications for Developers

This discovery highlights the risks associated with using copied or similarly named packages in software development. The sophisticated method of hiding and triggering the malicious payload underscores the need for thorough security analysis of third-party dependencies, even those appearing to be benign copies of popular libraries.