discovered 2026-09-18
mathjs clone (Deployment A) carrying the environmental-keying encrypted loader across three versions. SafeDep-confirmed; shares Deployment A C2 with mathmain.