mathsbase

discovered 2026-09-18

mathjs clone (Deployment B) carrying the same loader/trigger with a different encrypted graph.js blob; Ethereum Sepolia smart-contract C2 sharing Alchemy key D2-TbkB2m05WXSnSDOCDI with Deployment A. SafeDep-confirmed. Sibling versions 1.0.0 (2026-08-26, no loader) and default 1.0.2 (2026-09-15, no loader, hid the malicious 1.0.1) were clean. Slack Workspace B bot token prefix xoxb-11307403103236-11289767127959-... (no schema indicator kind for Slack tokens).

Threat types

rat
c2 agent
typosquat

Malicious versions

1.0.1 · 03e13cdedd9c33e6…

Campaigns

MathMain npm Supply Chain Attackattributed-to

Indicators

wallet0xE390863Dac96a7118C71227C2b099B50cF602D31communicates-with
urlhttps://eth-sepolia.g.alchemy.com/v2/D2-TbkB2m05WXSnSDOCDIcommunicates-with
sha256ab66c98e8ed5235feb963ec8845765f62f5f26b1c58c266c409767e53bcb5ccdindicates
sha2565d9e952c51875d2b897eedc22b002b94ab21c8004d513bc99ce3a885f8a01daeindicates
sha2560aa46d32e4b479cc09f97cc66a1f12ca96b0497a7eb6ffc6b46ed3ef80e3c83bindicates
github repotinystar8/mathsbaseindicates

Techniques

ttpT1195.002 Compromise Software Supply Chainuses
ttpT1480.001 Environmental Keyinguses
ttpT1027 Obfuscated Files or Informationuses
ttpT1140 Deobfuscate/Decode Files or Informationuses
ttpT1102.001 Dead Drop Resolveruses
ttpT1102 Web Serviceuses

Read the full analysis

APIThreat Intel Feed API · Confirmed malicious packages, campaigns and IOCs, piped into your stackExplore the API