GoKawiilFake mathjs npm package hides encrypted backdoor triggered by equation solving
Security researchers at SafeDep discovered that a malicious npm package called mathmain, disguised as a copy of the popular mathjs library, contains a hidden remote access implant. The malicious code stays encrypted and dormant until a specific equation is solved using the library's lusolve() solver function, which acts as a decryption key to unlock and execute the payload.
GoKawiil's interpretation of the reporting above, not reported fact.
This attack technique is notably stealthy because the malicious code only activates under precise mathematical conditions, making it far harder for automated scanners or manual code review to detect than typical malware. The payload also communicates via a public chat service and blockchain network, giving attackers a resilient, hard-to-block command channel once the implant is triggered inside a victim's environment.
- A trojanized npm package named mathmain mimics mathjs but hides an encrypted backdoor inside solver code.
- The malicious payload only decrypts and runs when a specific equation is solved, using the result as a decryption key.
- The implant uses chat and blockchain services as covert command-and-control channels, complicating detection and takedown.
Source: safedep.io, 2026-09-21
Published there as: “Why Does an NPM Math Library Need an Encrypted Loader?”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.