{
  "campaign": {
    "name": "MathMain npm Supply Chain Attack",
    "slug": "mathmain-npm-supply-chain-attack",
    "href": "/ti/campaigns/mathmain-npm-supply-chain-attack",
    "description": "Multi-incident, multi-identity npm supply chain operation running an environmentally-keyed AES-256-GCM remote access loader inside mathjs clones and other math/matrix/events/mutex/btree/graph utility packages. The payload decrypts only when a caller runs the package's lusolve() solver on the trigger matrix [[1,1,1],[1,2,3],[1,3,6]], whose LU lower factor JSON [[1,0,0],[1,1,0],[1,0.5,1]] is the decryption password; there is no install hook and a plain require never reaches the loader. SafeDep independently analyzed and confirmed the loader in mathmain@1.0.0, mathsbase@1.0.1, and math-universe@1.0.0/1.0.1/1.0.2 with full hashes. Deployment A (mathmain + math-universe) uses a Base Sepolia contract 0xac0bfC4C48A679b667732128278EACBA1c191894; Deployment B (mathsbase@1.0.1) uses an Ethereum Sepolia contract 0xE390863Dac96a7118C71227C2b099B50cF602D31; both share Alchemy project key D2-TbkB2m05WXSnSDOCDI. The multi-stage implant does os/fs recon, generates an X25519 keypair, reads the smart contract via bundled ethers 5.7.2 over public Infura/Alchemy RPC for operator tasking, and runs a Slack agent (conversations.history polling, operator-gated, 140-char chunked file transfer, Slack Workspace B bot token prefix xoxb-11307403103236-11289767127959-...) plus a Telegram channel, ultimately writing and running lib/cjs/utils/subwatcher and marking LICENSE with 'REDISTRIBUTION REQUIRES INCLUSION OF THIS LICENSE.'. The wider operation (about 24 npm packages, 14 smart-contract C2 endpoints, Slack/Telegram infrastructure, throwaway npm/GitHub identities, and a 30-repo GitHub-Actions download-count inflation worker farm over roughly six months) is tracked by external campaign research as 'Equation of Compromise' and is included here for coverage but is reported, not independently verified by SafeDep. Unattributed actor.",
    "objective": "Deliver an operator-controlled remote access implant to quantitative/DeFi developers via trojanized math/utility npm packages, gated behind an environmental key so only the intended caller workflow activates it. Victim scope unknown; no operator-delivered later-stage code recovered.",
    "aliases": [
      "Equation of Compromise",
      "mathmain encrypted loader"
    ],
    "discovered_at": "2026-09-18"
  },
  "packages": [
    {
      "ecosystem": "npm",
      "name": "mathmain",
      "href": "/ti/packages/npm/mathmain",
      "threat_types": [
        "rat",
        "c2_agent",
        "typosquat"
      ],
      "versions": [
        "1.0.0"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "mathsbase",
      "href": "/ti/packages/npm/mathsbase",
      "threat_types": [
        "rat",
        "c2_agent",
        "typosquat"
      ],
      "versions": [
        "1.0.1"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "math-universe",
      "href": "/ti/packages/npm/math-universe",
      "threat_types": [
        "rat",
        "c2_agent",
        "typosquat"
      ],
      "versions": [
        "1.0.0",
        "1.0.2",
        "1.0.1"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "modern-events",
      "href": "/ti/packages/npm/modern-events",
      "threat_types": [
        "rat",
        "c2_agent"
      ],
      "versions": [
        "1.3.3"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "quick-events",
      "href": "/ti/packages/npm/quick-events",
      "threat_types": [
        "rat",
        "c2_agent"
      ],
      "versions": [
        "2.1.3"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "@ignacionunez91/keccak24",
      "href": "/ti/packages/npm/@ignacionunez91/keccak24",
      "threat_types": [
        "rat",
        "c2_agent"
      ],
      "versions": [
        "1.0.7"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "crypto-hasher",
      "href": "/ti/packages/npm/crypto-hasher",
      "threat_types": [
        "rat",
        "c2_agent"
      ],
      "versions": [
        "3.1.2",
        "3.1.3"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "events-router",
      "href": "/ti/packages/npm/events-router",
      "threat_types": [
        "rat",
        "c2_agent"
      ],
      "versions": [
        "2.1.4"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "events-runtime",
      "href": "/ti/packages/npm/events-runtime",
      "threat_types": [
        "rat",
        "c2_agent"
      ],
      "versions": [
        "3.1.3"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "events-channel",
      "href": "/ti/packages/npm/events-channel",
      "threat_types": [
        "rat",
        "c2_agent"
      ],
      "versions": [
        "2.3.1"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "sort-btree",
      "href": "/ti/packages/npm/sort-btree",
      "threat_types": [
        "rat",
        "c2_agent"
      ],
      "versions": [
        "2.1.6",
        "2.2.0"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "ordered-btree",
      "href": "/ti/packages/npm/ordered-btree",
      "threat_types": [
        "rat",
        "c2_agent"
      ],
      "versions": [
        "3.2.2"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "indexed-btree",
      "href": "/ti/packages/npm/indexed-btree",
      "threat_types": [
        "rat",
        "c2_agent"
      ],
      "versions": [
        "2.1.2"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "@andrewstory18/is-real-odd",
      "href": "/ti/packages/npm/@andrewstory18/is-real-odd",
      "threat_types": [
        "rat",
        "c2_agent"
      ],
      "versions": [
        "2.0.3"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "@oliviamcdaniel12/safer-buffer",
      "href": "/ti/packages/npm/@oliviamcdaniel12/safer-buffer",
      "threat_types": [
        "rat",
        "c2_agent"
      ],
      "versions": [
        "2.2.0",
        "2.2.1"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "mutex-forge",
      "href": "/ti/packages/npm/mutex-forge",
      "threat_types": [
        "rat",
        "c2_agent"
      ],
      "versions": [
        "2.0.0"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "mutex-thread",
      "href": "/ti/packages/npm/mutex-thread",
      "threat_types": [
        "rat",
        "c2_agent"
      ],
      "versions": [
        "1.3.0"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "mutex-core",
      "href": "/ti/packages/npm/mutex-core",
      "threat_types": [
        "rat",
        "c2_agent"
      ],
      "versions": [
        "2.1.2"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "mutex-plus",
      "href": "/ti/packages/npm/mutex-plus",
      "threat_types": [
        "rat",
        "c2_agent"
      ],
      "versions": [
        "3.0.2"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "mutex-lite",
      "href": "/ti/packages/npm/mutex-lite",
      "threat_types": [
        "rat",
        "c2_agent"
      ],
      "versions": [
        "1.4.2"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "matrixflow-js",
      "href": "/ti/packages/npm/matrixflow-js",
      "threat_types": [
        "rat",
        "c2_agent"
      ],
      "versions": [
        "3.2.1"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "matrixkit-js",
      "href": "/ti/packages/npm/matrixkit-js",
      "threat_types": [
        "rat",
        "c2_agent"
      ],
      "versions": [
        "1.0.0"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "graphcore-js",
      "href": "/ti/packages/npm/graphcore-js",
      "threat_types": [
        "rat",
        "c2_agent"
      ],
      "versions": [
        "2.3.2"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "graphlib-js",
      "href": "/ti/packages/npm/graphlib-js",
      "threat_types": [
        "rat",
        "c2_agent"
      ],
      "versions": [
        "1.2.0"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "secure-library-loader",
      "href": "/ti/packages/npm/secure-library-loader",
      "threat_types": [
        "other"
      ],
      "versions": [
        "0.1.0"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "matrixhub",
      "href": "/ti/packages/npm/matrixhub",
      "threat_types": [
        "other"
      ],
      "versions": [
        "6.15.0"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "matrix-ops-core",
      "href": "/ti/packages/npm/matrix-ops-core",
      "threat_types": [
        "other"
      ],
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "indicators": [
    {
      "kind": "wallet",
      "value": "0x906f019AC38bB572a8f7d8b2cA662D624EDebaff",
      "href": "/ti/ioc/wallet/0x906f019AC38bB572a8f7d8b2cA662D624EDebaff",
      "context": "Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep)"
    },
    {
      "kind": "wallet",
      "value": "0x2707BbD5CF9b2F7cE37e4913BADC0349272d48cf",
      "href": "/ti/ioc/wallet/0x2707BbD5CF9b2F7cE37e4913BADC0349272d48cf",
      "context": "Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep)"
    },
    {
      "kind": "wallet",
      "value": "0x2a8536AdA44816Cb049778d24b75d795987D90b1",
      "href": "/ti/ioc/wallet/0x2a8536AdA44816Cb049778d24b75d795987D90b1",
      "context": "Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep)"
    },
    {
      "kind": "wallet",
      "value": "0x4C0c9B92BB9647fAf45022BA55f02bB0950196de",
      "href": "/ti/ioc/wallet/0x4C0c9B92BB9647fAf45022BA55f02bB0950196de",
      "context": "Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep)"
    },
    {
      "kind": "wallet",
      "value": "0xDe34270921D37124fd0b64ea3aE4c5062B467418",
      "href": "/ti/ioc/wallet/0xDe34270921D37124fd0b64ea3aE4c5062B467418",
      "context": "Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep)"
    },
    {
      "kind": "wallet",
      "value": "0x315d47b401aC29e97893dec1c85aBBB2791ef2aA",
      "href": "/ti/ioc/wallet/0x315d47b401aC29e97893dec1c85aBBB2791ef2aA",
      "context": "Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep)"
    },
    {
      "kind": "wallet",
      "value": "0x475B8659A33FB0C2bDB4c60ffdb92bC24d5c4015",
      "href": "/ti/ioc/wallet/0x475B8659A33FB0C2bDB4c60ffdb92bC24d5c4015",
      "context": "Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep)"
    },
    {
      "kind": "wallet",
      "value": "0xd5A4620278788AcCf388B7Ea5f35f849465728E7",
      "href": "/ti/ioc/wallet/0xd5A4620278788AcCf388B7Ea5f35f849465728E7",
      "context": "Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep)"
    },
    {
      "kind": "wallet",
      "value": "0x4b225b742eb31AD0DfD6bc00F8C55650b4394c18",
      "href": "/ti/ioc/wallet/0x4b225b742eb31AD0DfD6bc00F8C55650b4394c18",
      "context": "Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep)"
    },
    {
      "kind": "wallet",
      "value": "0x661e50E19f05E3c0d04fD75891456D1F0A24508D",
      "href": "/ti/ioc/wallet/0x661e50E19f05E3c0d04fD75891456D1F0A24508D",
      "context": "Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep)"
    },
    {
      "kind": "wallet",
      "value": "0xc0445F1b679DC46280A0f03F451bdf613b5A0feA",
      "href": "/ti/ioc/wallet/0xc0445F1b679DC46280A0f03F451bdf613b5A0feA",
      "context": "Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep)"
    },
    {
      "kind": "wallet",
      "value": "0x9E4dF8F253Eb439dd9538Fda30cC03B38fD3a631",
      "href": "/ti/ioc/wallet/0x9E4dF8F253Eb439dd9538Fda30cC03B38fD3a631",
      "context": "Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep)"
    },
    {
      "kind": "url",
      "value": "https://eth-sepolia.g.alchemy.com/v2/0E6xblLeXLnZSnn280R-O",
      "href": "/ti/ioc/url/url-3b99f26cc081",
      "context": "RPC (Alchemy), Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep)"
    },
    {
      "kind": "url",
      "value": "https://sepolia.infura.io/v3/d3d6e819028346a0b973bd5dd371c468",
      "href": "/ti/ioc/url/url-3e46e80e4c2d",
      "context": "RPC (Infura), Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep)"
    },
    {
      "kind": "url",
      "value": "https://sepolia.infura.io/v3/dc7257d09fab42eca2c354c32fec1938",
      "href": "/ti/ioc/url/url-6baa28d2ad48",
      "context": "RPC (Infura), Ethereum Sepolia; same Infura key as Deployment A (reported by external campaign tracking, not independently verified by SafeDep)"
    },
    {
      "kind": "url",
      "value": "https://eth-sepolia.g.alchemy.com/v2/NObVGNvMv3xNnlHDx3QYc",
      "href": "/ti/ioc/url/url-e2d309f32394",
      "context": "RPC (Alchemy), Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep)"
    },
    {
      "kind": "telegram_bot",
      "value": "8717417715",
      "href": "/ti/ioc/telegram_bot/8717417715",
      "context": "Telegram bot (chat -1003968723972) (reported, not independently verified by SafeDep)"
    },
    {
      "kind": "telegram_bot",
      "value": "8836581068",
      "href": "/ti/ioc/telegram_bot/8836581068",
      "context": "Telegram bot (operator monitoring, alerts to @server_alert_0630) (reported, not independently verified by SafeDep)"
    },
    {
      "kind": "email",
      "value": "tinystar368@proton.me",
      "href": "/ti/ioc/email/tinystar368@proton.me",
      "context": "Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts."
    },
    {
      "kind": "email",
      "value": "elenahorn97@proton.me",
      "href": "/ti/ioc/email/elenahorn97@proton.me",
      "context": "Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts."
    },
    {
      "kind": "email",
      "value": "allennightgale0812@outlook.com",
      "href": "/ti/ioc/email/allennightgale0812@outlook.com",
      "context": "Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts."
    },
    {
      "kind": "email",
      "value": "lin.n.ping@proton.me",
      "href": "/ti/ioc/email/lin.n.ping@proton.me",
      "context": "Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts."
    },
    {
      "kind": "email",
      "value": "hunterhicks18@proton.me",
      "href": "/ti/ioc/email/hunterhicks18@proton.me",
      "context": "Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts."
    },
    {
      "kind": "email",
      "value": "jamesmorse82@proton.me",
      "href": "/ti/ioc/email/jamesmorse82@proton.me",
      "context": "Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts."
    },
    {
      "kind": "email",
      "value": "mona.willis@outlook.com",
      "href": "/ti/ioc/email/mona.willis@outlook.com",
      "context": "Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts."
    },
    {
      "kind": "email",
      "value": "andrew.story18@outlook.com",
      "href": "/ti/ioc/email/andrew.story18@outlook.com",
      "context": "Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts."
    },
    {
      "kind": "email",
      "value": "david.babcock96@outlook.com",
      "href": "/ti/ioc/email/david.babcock96@outlook.com",
      "context": "Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts."
    },
    {
      "kind": "email",
      "value": "azlanrahman322@gmail.com",
      "href": "/ti/ioc/email/azlanrahman322@gmail.com",
      "context": "Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts."
    },
    {
      "kind": "email",
      "value": "mattpalmer0602@gmail.com",
      "href": "/ti/ioc/email/mattpalmer0602@gmail.com",
      "context": "Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts."
    },
    {
      "kind": "email",
      "value": "tinystar368@gmail.com",
      "href": "/ti/ioc/email/tinystar368@gmail.com",
      "context": "Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts."
    },
    {
      "kind": "email",
      "value": "justin.campos454@outlook.com",
      "href": "/ti/ioc/email/justin.campos454@outlook.com",
      "context": "Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts."
    },
    {
      "kind": "email",
      "value": "gerry.smith2026@outlook.com",
      "href": "/ti/ioc/email/gerry.smith2026@outlook.com",
      "context": "Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts."
    },
    {
      "kind": "email",
      "value": "wesley.moses97@outlook.com",
      "href": "/ti/ioc/email/wesley.moses97@outlook.com",
      "context": "Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts."
    },
    {
      "kind": "email",
      "value": "joseph.jordan93@outlook.com",
      "href": "/ti/ioc/email/joseph.jordan93@outlook.com",
      "context": "Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts."
    },
    {
      "kind": "email",
      "value": "lesstafford24@outlook.com",
      "href": "/ti/ioc/email/lesstafford24@outlook.com",
      "context": "Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts."
    },
    {
      "kind": "email",
      "value": "angelinaparrish18@outlook.com",
      "href": "/ti/ioc/email/angelinaparrish18@outlook.com",
      "context": "Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts."
    },
    {
      "kind": "email",
      "value": "ignacionunez91@outlook.com",
      "href": "/ti/ioc/email/ignacionunez91@outlook.com",
      "context": "Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts."
    },
    {
      "kind": "email",
      "value": "moniquemeza22@outlook.com",
      "href": "/ti/ioc/email/moniquemeza22@outlook.com",
      "context": "Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts."
    },
    {
      "kind": "email",
      "value": "bradley.steven93@outlook.com",
      "href": "/ti/ioc/email/bradley.steven93@outlook.com",
      "context": "Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts."
    },
    {
      "kind": "github_repo",
      "value": "andrewstory18/worker1",
      "href": "/ti/ioc/github_repo/github_repo-5a8f705b0a82",
      "context": "download-inflation worker repo (1 of ~10 under andrewstory18) (reported, not independently verified by SafeDep). Representative sample of a ~30-repo worker farm across 4 accounts."
    },
    {
      "kind": "github_repo",
      "value": "davidbabcock96/job_worker1",
      "href": "/ti/ioc/github_repo/github_repo-a71c86c9882a",
      "context": "download-inflation worker repo (1 of ~10 under davidbabcock96) (reported, not independently verified by SafeDep). Representative sample of a ~30-repo worker farm across 4 accounts."
    },
    {
      "kind": "github_repo",
      "value": "azlanrahman322-creator/job-worker1",
      "href": "/ti/ioc/github_repo/github_repo-271cd10c873b",
      "context": "download-inflation worker repo (1 of ~10 under azlanrahman322-creator) (reported, not independently verified by SafeDep). Representative sample of a ~30-repo worker farm across 4 accounts."
    },
    {
      "kind": "github_repo",
      "value": "UmajiHidekata/jobworker",
      "href": "/ti/ioc/github_repo/github_repo-b3aa8aa2bea4",
      "context": "download-inflation worker repo (reported, not independently verified by SafeDep). Representative sample of a ~30-repo worker farm across 4 accounts."
    },
    {
      "kind": "file_path",
      "value": "lib/cjs/utils/subwatcher",
      "href": "/ti/ioc/file_path/file_path-1e793caf7787",
      "context": "Dropped attacker artifact written and executed by the implant (Slack and blockchain paths). Not a mathjs file, so the strongest on-disk path signature."
    },
    {
      "kind": "md5",
      "value": "91e020c13cb97a6365135b53b0d0fe5f",
      "href": "/ti/ioc/md5/91e020c13cb97a6365135b53b0d0fe5f",
      "context": "WASM download-inflation decoder (reported, not independently verified by SafeDep; hardcoded key npm_workvr_protect_key_v1)."
    },
    {
      "kind": "wallet",
      "value": "0xac0bfC4C48A679b667732128278EACBA1c191894",
      "href": "/ti/ioc/wallet/0xac0bfC4C48A679b667732128278EACBA1c191894",
      "context": "Deployment A smart contract C2, Base Sepolia (SafeDep-confirmed; mathmain + math-universe)"
    },
    {
      "kind": "url",
      "value": "https://base-sepolia.infura.io/v3/dc7257d09fab42eca2c354c32fec1938",
      "href": "/ti/ioc/url/url-76c38c2c4984",
      "context": "Deployment A RPC (Infura), Base Sepolia (SafeDep-confirmed)"
    },
    {
      "kind": "url",
      "value": "https://base-sepolia.g.alchemy.com/v2/D2-TbkB2m05WXSnSDOCDI",
      "href": "/ti/ioc/url/url-78a78a2d08e1",
      "context": "Deployment A RPC (Alchemy), Base Sepolia (SafeDep-confirmed); shared Alchemy project key"
    },
    {
      "kind": "telegram_bot",
      "value": "8961878831",
      "href": "/ti/ioc/telegram_bot/8961878831",
      "context": "Deployment A Telegram bot (SafeDep-confirmed; chats -1003952553968, -1004489630130)"
    },
    {
      "kind": "sha256",
      "value": "ab66c98e8ed5235feb963ec8845765f62f5f26b1c58c266c409767e53bcb5ccd",
      "href": "/ti/ioc/sha256/ab66c98e8ed5235feb963ec8845765f62f5f26b1c58c266c409767e53bcb5ccd",
      "context": "Loader file lib/cjs/utils/event.js (SafeDep-confirmed; identical across all 5 versions)."
    },
    {
      "kind": "sha256",
      "value": "5d9e952c51875d2b897eedc22b002b94ab21c8004d513bc99ce3a885f8a01dae",
      "href": "/ti/ioc/sha256/5d9e952c51875d2b897eedc22b002b94ab21c8004d513bc99ce3a885f8a01dae",
      "context": "Loader file lib/cjs/utils/is.js (SafeDep-confirmed; identical across all 5 versions)."
    },
    {
      "kind": "sha256",
      "value": "ed9b078594393d09d91ee008366ca75e3017cca18c79af99c5b294c61db67f06",
      "href": "/ti/ioc/sha256/ed9b078594393d09d91ee008366ca75e3017cca18c79af99c5b294c61db67f06",
      "context": "Encrypted payload lib/cjs/utils/graph.js, Deployment A (SafeDep-confirmed)."
    },
    {
      "kind": "sha256",
      "value": "09773ee7db70216b778b15cfcd94cb1df8963eddd4a47b801c96f986651699e6",
      "href": "/ti/ioc/sha256/09773ee7db70216b778b15cfcd94cb1df8963eddd4a47b801c96f986651699e6",
      "context": "Encrypted payload lib/cjs/utils/fraction.js, Deployment A (SafeDep-confirmed)."
    },
    {
      "kind": "sha256",
      "value": "ca4fe552da461fec5b51d5964d979699f06888499be442f209125853dff3e0e1",
      "href": "/ti/ioc/sha256/ca4fe552da461fec5b51d5964d979699f06888499be442f209125853dff3e0e1",
      "context": "Encrypted payload lib/cjs/utils/bignumber/type.js, Deployment A (SafeDep-confirmed)."
    },
    {
      "kind": "sha256",
      "value": "1e0f09c84aaf573627c003ce0f086517c3ea980cbea02f8ff918b1cc0d7e0bbb",
      "href": "/ti/ioc/sha256/1e0f09c84aaf573627c003ce0f086517c3ea980cbea02f8ff918b1cc0d7e0bbb",
      "context": "Decrypted payload lib/cjs/utils/graph.js, Deployment A (SafeDep-confirmed; on-disk after loader runs)."
    },
    {
      "kind": "sha256",
      "value": "6fd655d7196880fc5783f9dbb62b428baf220c2781970be54044376330be7af3",
      "href": "/ti/ioc/sha256/6fd655d7196880fc5783f9dbb62b428baf220c2781970be54044376330be7af3",
      "context": "Decrypted payload lib/cjs/utils/fraction.js, Deployment A (SafeDep-confirmed; Slack agent)."
    },
    {
      "kind": "sha256",
      "value": "6b1ad71bc3765dd272ea2ac63c1ea6ed97091ba0067d0b3e2294e1b34177cb25",
      "href": "/ti/ioc/sha256/6b1ad71bc3765dd272ea2ac63c1ea6ed97091ba0067d0b3e2294e1b34177cb25",
      "context": "Decrypted payload lib/cjs/utils/bignumber/type.js, Deployment A (SafeDep-confirmed; bundled ethers 5.7.2)."
    },
    {
      "kind": "wallet",
      "value": "0xE390863Dac96a7118C71227C2b099B50cF602D31",
      "href": "/ti/ioc/wallet/0xE390863Dac96a7118C71227C2b099B50cF602D31",
      "context": "Deployment B smart contract C2, Ethereum Sepolia (SafeDep-confirmed; mathsbase@1.0.1)"
    },
    {
      "kind": "url",
      "value": "https://eth-sepolia.g.alchemy.com/v2/D2-TbkB2m05WXSnSDOCDI",
      "href": "/ti/ioc/url/url-a37084f80a39",
      "context": "Deployment B RPC (Alchemy), Ethereum Sepolia (SafeDep-confirmed); same Alchemy project key as Deployment A"
    },
    {
      "kind": "sha256",
      "value": "0aa46d32e4b479cc09f97cc66a1f12ca96b0497a7eb6ffc6b46ed3ef80e3c83b",
      "href": "/ti/ioc/sha256/0aa46d32e4b479cc09f97cc66a1f12ca96b0497a7eb6ffc6b46ed3ef80e3c83b",
      "context": "Encrypted payload lib/cjs/utils/graph.js, Deployment B (SafeDep-confirmed; mathsbase@1.0.1)."
    },
    {
      "kind": "github_repo",
      "value": "tinystar8/mathsbase",
      "href": "/ti/ioc/github_repo/github_repo-a92b0a9e950f",
      "context": "Attacker source repo for mathsbase; the loader is in the npm build only, not this GitHub source (commit 560d97e66140dbf817e04284a7a0c58757d1202e)."
    },
    {
      "kind": "github_repo",
      "value": "mathubio/math-universe",
      "href": "/ti/ioc/github_repo/github_repo-9188a7db706c",
      "context": "Attacker source repo for math-universe; loader in npm build only, not this GitHub source (commit da99dd46501c75ba6102a51ef60ebb922174da32)."
    }
  ],
  "ttps": [
    {
      "name": "Download Count Inflation",
      "href": "/ti/ttps/download-count-inflation"
    },
    {
      "name": "Compromise Software Supply Chain",
      "mitre_attack_id": "T1195.002",
      "href": "/ti/ttps/T1195.002"
    },
    {
      "name": "Environmental Keying",
      "mitre_attack_id": "T1480.001",
      "href": "/ti/ttps/T1480.001"
    },
    {
      "name": "Obfuscated Files or Information",
      "mitre_attack_id": "T1027",
      "href": "/ti/ttps/T1027"
    },
    {
      "name": "Deobfuscate/Decode Files or Information",
      "mitre_attack_id": "T1140",
      "href": "/ti/ttps/T1140"
    },
    {
      "name": "Dead Drop Resolver",
      "mitre_attack_id": "T1102.001",
      "href": "/ti/ttps/T1102.001"
    },
    {
      "name": "Web Service",
      "mitre_attack_id": "T1102",
      "href": "/ti/ttps/T1102"
    }
  ],
  "related_campaigns": [],
  "reports": [
    {
      "title": "Why Does an npm Math Library Need an Encrypted Loader?",
      "url": "https://safedep.io/mathmain-encrypted-loader",
      "published_at": "2026-09-18"
    }
  ]
}