conv.

All stories
SecurityQuiet 2d · day 3

SafeDep discovers encrypted remote access malware in npm's mathmain package

A fake mathjs library ships with an encrypted loader that decrypts and executes code when triggered with specific matrix data.

newest coverage 2d agosummary written 2d ago4 pieces137 likes & upvotes41 comments Hacker NewsMastodonNewswires

What to know

  • An npm package called mathmain impersonates the popular mathjs library but contains a remote access implant with an encrypted loader.
  • The malware activates only when called with specific matrix data that decrypts the payload; no password is stored in plain text.
  • Once activated, the implant executes code supplied by an operator and communicates via public chat services and blockchain.
  • SafeDep has published technical analysis with detection indicators to help identify and protect against the malware.

SafeDep Security researcher

SafeDep discovers encrypted remote access malware in npm's mathmain package
safedep.io

How it unfolded 1 development · click the chart to see its coverage articlesposts

Peak 2 pieces in one hour at Sep 21, 1 PM; 4 pieces over 3 days (1 article · 3 posts) Sep 21, 1 PM — 2 pieces · 1 article · 1 post — Hacker News 1, Newswires 1Sep 21, 2 PM — 2 pieces · 2 posts — Mastodon 2Sep 21, 3 PM — quietSep 21, 4 PM — quietSep 21, 5 PM — quietSep 21, 6 PM — quietSep 21, 7 PM — quietSep 21, 8 PM — quietSep 21, 9 PM — quietSep 21, 10 PM — quietSep 21, 11 PM — quietSep 22, 12 AM — quietSep 22, 1 AM — quietSep 22, 2 AM — quietSep 22, 3 AM — quietSep 22, 4 AM — quietSep 22, 5 AM — quietSep 22, 6 AM — quietSep 22, 7 AM — quietSep 22, 8 AM — quietSep 22, 9 AM — quietSep 22, 10 AM — quietSep 22, 11 AM — quietSep 22, 12 PM — quietSep 22, 1 PM — quietSep 22, 2 PM — quietSep 22, 3 PM — quietSep 22, 4 PM — quietSep 22, 5 PM — quietSep 22, 6 PM — quietSep 22, 7 PM — quietSep 22, 8 PM — quietSep 22, 9 PM — quietSep 22, 10 PM — quietSep 22, 11 PM — quietYesterday, 12 AM — quietYesterday, 1 AM — quietYesterday, 2 AM — quietYesterday, 3 AM — quietYesterday, 4 AM — quietYesterday, 5 AM — quietYesterday, 6 AM — quietYesterday, 7 AM — quietYesterday, 8 AM — quietYesterday, 9 AM — quietYesterday, 10 AM — quietYesterday, 11 AM — quietYesterday, 12 PM — quietYesterday, 1 PM — quietYesterday, 2 PM — quietYesterday, 3 PM — quietYesterday, 4 PM — quietYesterday, 5 PM — quietYesterday, 6 PM — quietYesterday, 7 PM — quietYesterday, 8 PM — quietYesterday, 9 PM — quietYesterday, 10 PM — quietYesterday, 11 PM — quietToday, 12 AM — quietToday, 1 AM — quiet ◂ 1 earlier
Sep 22yesterdaynow · 2:56 AM ET
  1. 1

    SafeDep publishes full technical analysis with decryption details and indicators

    A detailed write-up shows how the loader works, how to decrypt it, what the payload does, and provides indicators for detection. The analysis reveals no install hooks are present—the password must match matrix data provided by a caller to activate the malware.

    “We found a remote access implant hidden inside [email protected], an npm package that copies the popular mathjs library. The malicious code ships encrypted.”
    — SafeDep
  2. background

    Malware payload receives encrypted commands via chat and blockchain — Once decrypted and executed, the payload runs as a remote access implant that receives encrypted code from an operator and executes it with Node.js process permissions. Communication occurs over a public chat service and blockchain network.

  3. background

    Researchers trace loader to encrypted decryption mechanism using AES-GCM — Investigation revealed the extra solver call routes to isGraph(), which uses matrix data as a password to decrypt a filename via scrypt and AES-GCM encryption. The decrypted filename points to graph.js, which is then loaded with require().

  4. background

    SafeDep discovers obfuscated mathmain package with hidden loader — SafeDep's analysis of mathmain identified it as a copy of mathjs with obfuscated code and an unusual extra call in the solver function that did not use its return value.