discovered
Reported by external campaign tracking as part of the MathMain npm Supply Chain Attack / Equation of Compromise family, not independently verified by SafeDep. Masquerades as a math/matrix/events/mutex/btree/graph utility; version ranges and dates as reported.