Hacker News front pageSafeDep Team10 min readintermediate
Why Does an NPM Math Library Need an Encrypted Loader?
Summary
SafeDep discovered that several npm packages masquerading as mathjs contain an encrypted loader that only activates when a caller passes a particular matrix to the LU solver, using the matrix’s lower‑triangular factor as the decryption password. The loader decrypts and executes a multi‑stage remote‑access implant that talks to Slack, Telegram and a blockchain contract, and the same technique is r…
- The malicious loader is triggered by passing a specific 3×3 Pascal matrix to lusolve; the lower‑triangular factor L (JSON‑stringified) serves as the AES‑GCM password.
- The loader uses scrypt‑derived keys to decrypt large encrypted blobs (graph.js, fraction.js, bignumber/type.js), writes them to disk and require()s them, giving the attacker code execution with Node’s privileges.
- The payload implements a remote‑access implant: generates X25519 keys, reads a Base Sepolia smart contract via ethers, and exfiltrates commands via Slack and Telegram bots.
- Identical loader files and encrypted payloads appear in three npm packages (mathmain, mathsbase, math‑universe) across multiple versions, none of which are present in the linked public GitHub repos.
Supply‑chain security teams and Node.js developers should care because a seemingly innocuous math library can hide a stealthy remote‑access implant triggered by specific inputs, exposing systems to unauthorized code execution.
7/10
