discovered 2026-09-18
Reported by external campaign tracking as part of the MathMain npm Supply Chain Attack / Equation of Compromise family, not independently verified by SafeDep. Reported potentially-unwanted / support package associated with the operation.
