malware
npm
mathsbase
discovered 2026-09-18mathjs clone (Deployment B) carrying the same loader/trigger with a different encrypted graph.js blob; Ethereum Sepolia smart-contract C2 sharing Alchemy key D2-TbkB2m05WXSnSDOCDI with Deployment A. SafeDep-confirmed. Sibling versions 1.0.0 (2026-08-26, no loader) and default 1.0.2 (2026-09-15, no loader, hid the malicious 1.0.1) were clean. Slack Workspace B bot token prefix xoxb-11307403103236-11289767127959-... (no schema indicator kind for Slack tokens).
Threat types
rat c2_agent typosquat
Malicious versions
- 1.0.1 · 03e13cdedd9c33e6…
Campaigns
Indicators
- wallet 0xE390863Dac96a7118C71227C2b099B50cF602D31communicates-with
- url https://eth-sepolia.g.alchemy.com/v2/D2-TbkB2m05WXSnSDOCDIcommunicates-with
- sha256 ab66c98e8ed5235feb963ec8845765f62f5f26b1c58c266c409767e53bcb5ccdindicates
- sha256 5d9e952c51875d2b897eedc22b002b94ab21c8004d513bc99ce3a885f8a01daeindicates
- sha256 0aa46d32e4b479cc09f97cc66a1f12ca96b0497a7eb6ffc6b46ed3ef80e3c83bindicates
- github_repo tinystar8/mathsbaseindicates
