Researchers discovered that three npm packages — mathmain, mathsbase and math-universe — embed an encrypted loader that activates only when a specific matrix password is supplied. The loader decrypts and executes a multi-stage remote access implant capable of contacting Slack, Telegram and blockchain networks.

The trigger password derives from the lower triangular factor of a 3×3 Pascal matrix. When a caller invokes lusolve() with the matrix [[1,1,1],[1,2,3],[1,3,6]], the solver produces the factor [[1,0,0],[1,1,0],[1,0.5,1]]. Converting that factor to JSON yields the password that unlocks the loader.

The malicious code resides in lib/cjs/utils/event.js and related files. It uses scrypt to derive a 256‑bit key, then decrypts payloads with AES‑GCM. The decrypted graph.js file serves as stage one, spawning child processes, generating X25519 key pairs, and communicating via Slack and Telegram. It also loads bignumber/type.js and fraction.js as later stages, using them to interact with Ethereum Sepolia smart contracts and to parse Slack messages.

Static analysis of the decrypted payloads shows they contain base64‑encoded constants pointing to Base Sepolia RPC endpoints, a Telegram bot token and a Slack bot token. The implant polls Slack’s history endpoint every ten seconds, decrypts incoming messages, and processes them as JSON packets that may trigger file transfers.

The loader remains dormant unless the correct password is provided. A normal import of the package does not activate it; the caller must first pass the matrix through the solver’s validation routine. If the password is incorrect, the authentication check fails before any file is written.

Further investigation revealed that the same loader appears in five versions of mathmain, mathsbase and math-universe, with identical trigger code and encrypted payloads. The encrypted filename resolves to graph.js, which contains the stage‑one implant. The password also decrypts two additional payload files that are loaded later in the chain.

Download statistics from npm show 605,157 downloads of mathmain, 1,923,059 of mathsbase and 569,730 of math-universe within a single week in September 2026. However, npm reported zero downloads on September 17, casting doubt on earlier figures. No public repository or dependency graph references the trigger matrix, suggesting the initial infection vector has not been observed in open‑source projects.

Indicators of compromise include the SHA‑256 hashes of the malicious event.js and is.js files, as well as the base64 blobs stored under lib/cjs/utils/. The decrypted payloads share a common Alchemy project key, linking the command‑and‑control infrastructure across the three packages.

The discovery highlights the risk of compromised npm packages that hide malicious functionality behind cryptographic checks, emphasizing the need for thorough supply‑chain vetting and monitoring of unusual network activity originating from JavaScript dependencies.