malware
npm
mathmain
discovered 2026-09-18mathjs clone (Deployment A) carrying the environmental-keying encrypted loader. SafeDep-confirmed; decrypted payload byte-for-byte identical to math-universe. Base Sepolia smart-contract C2 + Slack/Telegram. Slack Workspace B bot token prefix xoxb-11307403103236-11289767127959-... (no schema indicator kind for Slack tokens).
Threat types
rat c2_agent typosquat
Malicious versions
- 1.0.0 · 1723a0df210ac612…
Campaigns
Indicators
- wallet 0xac0bfC4C48A679b667732128278EACBA1c191894communicates-with
- url https://base-sepolia.infura.io/v3/dc7257d09fab42eca2c354c32fec1938communicates-with
- url https://base-sepolia.g.alchemy.com/v2/D2-TbkB2m05WXSnSDOCDIcommunicates-with
- telegram_bot 8961878831communicates-with
- sha256 ab66c98e8ed5235feb963ec8845765f62f5f26b1c58c266c409767e53bcb5ccdindicates
- sha256 5d9e952c51875d2b897eedc22b002b94ab21c8004d513bc99ce3a885f8a01daeindicates
- sha256 ed9b078594393d09d91ee008366ca75e3017cca18c79af99c5b294c61db67f06indicates
- sha256 09773ee7db70216b778b15cfcd94cb1df8963eddd4a47b801c96f986651699e6indicates
- sha256 ca4fe552da461fec5b51d5964d979699f06888499be442f209125853dff3e0e1indicates
- sha256 1e0f09c84aaf573627c003ce0f086517c3ea980cbea02f8ff918b1cc0d7e0bbbindicates
- sha256 6fd655d7196880fc5783f9dbb62b428baf220c2781970be54044376330be7af3indicates
- sha256 6b1ad71bc3765dd272ea2ac63c1ea6ed97091ba0067d0b3e2294e1b34177cb25indicates
