Poisoned Pipeline / Incidents / AS36
mathmain / mathsbase encrypted npm RAT (equation trigger)
SafeDep and JFrog documented an npm campaign that copies mathjs under
new names (mathmain, mathsbase, math-universe) and ships an AES-256-GCM
loader with no install hooks. The loader stays dormant until a caller
runs lusolve() with a 3×3 Pascal matrix; the LU lower factor JSON is
the password. Decrypted stages are a remote-access implant that reads
a Base/Ethereum Sepolia contract, reports to Slack and Telegram, and
runs operator shell commands from Slack. The loader is in the npm
tarball, not in the public GitHub source. JFrog recovered the trigger
on 21 September 2026; SafeDep reproduced it against mathmain@1.0.0.
Reported download counts were inconsistent with dependents and
jsDelivr traffic. No public caller of the trigger matrix was found.
Mapped techniques
- T0129 Typosquatting
- T0141 Fake developer reputation (Starjacking)
- T0109 Publish malicious artifact
- T0150 Runtime logic bomb
- T0159 Malicious artifact execution
- T0172 Runtime backdoor
supply-chain npm mathjs copies with encrypted runtime loader
Packages copy mathjs under different names (mathmain, mathsbase, math-universe).
Public GitHub repos exist; neither holds the loader that npm ships.
mathsbase@1.0.1 (27 Aug), math-universe 1.0.0–1.0.2, mathmain@1.0.0 (17 Sep).
Payload decrypts only when lusolve() is called with one specific matrix.
No install hooks; import plus the trigger is required.
Decrypted agent polls Slack for shell commands; C2 also on-chain.