A mathematical operation unlocks the implant
JFrog and SafeDep have analysed malicious npm packages derived from popular mathematics libraries in which the harmful code is absent from the linked public GitHub source and appears only in the published package tarball. In the analysed mathmain, mathsbase and math-universe versions, a modified linear-equation solver feeds an intermediate matrix into an AES-256-GCM loader. Only one specific input produces the key that decrypts and runs the hidden files, allowing ordinary use of the package to appear normal.
JFrog recovered the trigger as a 3 by 3 symmetric Pascal matrix. SafeDep then reproduced the decryption against the published mathmain files and found a remote-access implant that can execute shell commands, collect host information and communicate through blockchain and chat infrastructure. SafeDep also confirmed that the malicious loader is missing from the GitHub histories it examined, placing the tampering at or around package publication rather than in the visible source repository.
The campaign uses public infrastructure for command and control
JFrog says the implant uses smart contracts on Ethereum Sepolia and Base Sepolia as one tasking channel. Its investigation maps 14 contracts deployed by five operator wallets between 5 March and 16 September, with eight contracts showing active enrolment. The contracts contain 1,080 taskings represented by 2,162 encrypted payload blobs, but those payloads are sealed to individual implants and JFrog says it cannot decrypt the final operator instructions.
A separate Slack component provides another tasking path, while the first-stage implant also reports through Slack and Telegram. The use of public RPC endpoints and ordinary collaboration services reduces reliance on a conventional command server that can be seized or blocked, but the published research does not establish what the final encrypted tasks instructed infected systems to do.
Fake popularity was produced with GitHub Actions workers
JFrog also traced inflated npm download counts to public GitHub repositories containing scheduled worker jobs. The workers decrypt package names from a configuration, fetch the corresponding npm tarball repeatedly and discard the bytes, creating registry download events without evidence of real adoption. JFrog mapped several worker farms and says the mechanism was still operating while it wrote its report.
That finding changes how the package popularity signal should be read. SafeDep had already warned that npm's reported download totals could not establish installations and found no public dependants plus almost no jsDelivr traffic for the suspicious packages. The later worker analysis supplies a mechanism for at least part of the inflation, but neither research team has a reliable count of genuinely infected machines.
Corroborated mechanics, incomplete campaign scope
The overlap between the two investigations is strong on the core mechanism. SafeDep independently reproduced JFrog's trigger, decrypted the first-stage files and identified the same shell-execution and blockchain behaviour. Both teams also observed malicious code in npm artefacts that was absent from the linked public repositories, which makes source-only review insufficient for this package family.
The broader six-month campaign map remains principally JFrog's attribution, and important questions stay open. JFrog infers that quantitative or DeFi developers were likely targets from the lures and trigger, but it did not recover a final operator payload that proves that objective. The 1,080 contract taskings are also not a victim count. A package match establishes exposure to a malicious artefact; it does not prove that the trigger executed or that a host was compromised.