We found a remote access implant hidden inside mathmain, an npm package that copies the popular mathjs library. The malicious code ships encrypted. It stays dormant until a program solves a specific equation with the library. That equation is the key. When the key matches, the package decrypts a payload and runs it. The payload takes commands from the attacker and runs them on the host. It uses a public chat service and a blockchain network for its command channel.

We started with a Safe Dep analysis of mathmain on September 17, 2026. The package looked like a copy of mathjs with a different name and obfuscated code. One added call in the solver led us to the loader. Near the end of lusolve(), we found an extra call in the Common JS build. The solver had already calculated its result. It then passed data from the lower triangular matrix to remove Solve Validation().

We followed remove Solve Validation() to is Graph(x) in lib/cjs/utils/is.js. The added is Graph() function decrypts and loads code. It converts its input to a JSON string and uses that string as a password. It first decrypts a filename. It then passes the file path and password to event(), and loads the returned path with require().

The matrix data becomes a password. In lib/cjs/utils/event.js, we found the decryption functions. They use scrypt to turn the password into a key of 256 bits. They then decrypt the data with AES-GCM. The loader writes and runs the file. The event() helper decrypts the file, writes the result to disk, and returns the output path.