Targeted Malware Campaign Using Malicious npm Packages

• •Malicious npm package mathsbase mimics mathjs, achieving six million downloads quickly.
• •The malware activates only after solving a specific linear equation, making it highly targeted.
• •Payload communicates via Ethereum smart contracts and Slack, indicating sophisticated command-and-control methods.

Recent analysis revealed a targeted malware campaign utilizing malicious npm packages that mimic the popular mathjs library. The malicious package, named mathsbase, was downloaded over six million times within two days of its release, despite having no dependencies. The malware remains dormant until a specific mathematical equation is solved, which acts as a key to decrypt and execute a payload. This payload communicates with the attacker via a smart contract on the Ethereum Sepolia testnet and a Slack channel. The campaign has been active for at least six months, with detailed analysis uncovering the methods used to obfuscate the malicious code and the encryption techniques employed. Security researchers have provided insights into the loader's operation and potential indicators of compromise (IOCs). The situation is ongoing, with more investigations likely to follow.