conv.

← The whole story
Security
SafeDep discovers encrypted remote access malware in npm's mathmain package

SafeDep publishes full technical analysis with decryption details and indicators

1 Sep 21 10:33 AM · 2d ago · 1 article · 3 posts · 3 sources · development 1 of 1

A detailed write-up shows how the loader works, how to decrypt it, what the payload does, and provides indicators for detection. The analysis reveals no install hooks are present—the password must match matrix data provided by a caller to activate the malware.

SafeDep publishes full technical analysis with decryption details and indicators
safedep.io

“We found a remote access implant hidden inside [email protected], an npm package that copies the popular mathjs library. The malicious code ships encrypted.”

SafeDep

SafeDep Security researcher

The whole story articlesposts the bright band is this development · numbered dots are the others · click one to jump

Peak 2 pieces in one hour at Sep 21, 1 PM; 4 pieces over 3 days (1 article · 3 posts) Sep 21, 1 PM — 2 pieces · 1 article · 1 post — Hacker News 1, Newswires 1Sep 21, 2 PM — 2 pieces · 2 posts — Mastodon 2Sep 21, 3 PM — quietSep 21, 4 PM — quietSep 21, 5 PM — quietSep 21, 6 PM — quietSep 21, 7 PM — quietSep 21, 8 PM — quietSep 21, 9 PM — quietSep 21, 10 PM — quietSep 21, 11 PM — quietSep 22, 12 AM — quietSep 22, 1 AM — quietSep 22, 2 AM — quietSep 22, 3 AM — quietSep 22, 4 AM — quietSep 22, 5 AM — quietSep 22, 6 AM — quietSep 22, 7 AM — quietSep 22, 8 AM — quietSep 22, 9 AM — quietSep 22, 10 AM — quietSep 22, 11 AM — quietSep 22, 12 PM — quietSep 22, 1 PM — quietSep 22, 2 PM — quietSep 22, 3 PM — quietSep 22, 4 PM — quietSep 22, 5 PM — quietSep 22, 6 PM — quietSep 22, 7 PM — quietSep 22, 8 PM — quietSep 22, 9 PM — quietSep 22, 10 PM — quietSep 22, 11 PM — quietYesterday, 12 AM — quietYesterday, 1 AM — quietYesterday, 2 AM — quietYesterday, 3 AM — quietYesterday, 4 AM — quietYesterday, 5 AM — quietYesterday, 6 AM — quietYesterday, 7 AM — quietYesterday, 8 AM — quietYesterday, 9 AM — quietYesterday, 10 AM — quietYesterday, 11 AM — quietYesterday, 12 PM — quietYesterday, 1 PM — quietYesterday, 2 PM — quietYesterday, 3 PM — quietYesterday, 4 PM — quietYesterday, 5 PM — quietYesterday, 6 PM — quietYesterday, 7 PM — quietYesterday, 8 PM — quietYesterday, 9 PM — quietYesterday, 10 PM — quietYesterday, 11 PM — quietToday, 12 AM — quietToday, 1 AM — quiet ◂ 1 earlier
Sep 22yesterdaynow · 2:57 AM ET

Reported in the same hours no headline names this development itself — these 1 claim were published in its stretch

  1. 1 outlet Why Does an NPM Math Library Need an Encrypted Loader?

    first by HN Frontpage, 2d ago

All 1 developments of SafeDep discovers encrypted remote access malware in npm's… →

Hacker NewsMastodonNewswires