Why does mathmain need an encrypted loader?

aabhisek about 4 hours ago 26 commentsRead Article on safedep.io

DE version is available. Content is displayed in original English for accuracy.

⚡ Community Insights

Discussion Sentiment

50% Positive

Analyzed from 612 words in the discussion.

Discussion (26 Comments)Read Original on HackerNews

j2kun•about 3 hours ago

Why in the world would that specific 3x3 matrix be a trigger for an attack? Are they trying to find someone doing some particular kind of numerical analysis?

ajkjk•about 2 hours ago

Perhaps they just need a way to sneakily activate it? Or perhaps they have a target application which they know uses that. This method suggests a supply chain attack where a valid contributor to a library 'accidentally' includes this package and the hack carries out before anyone notices.

My guess is that it's crypto related but of course it could be anything.

zarzavat•about 3 hours ago

Presumably it's so it can be used as a subdependency for setting up an attack in a popular, legitimate package, e.g. via a pull request. The code in the legitimate package would not arouse suspicion at all.

krackers•about 3 hours ago

Now I'm curious what the target was. Are there any notable classes of programs/problems where you'd do an LU decomposition of this specific matrix?

coder-pm•about 3 hours ago

This matrix is not a condition, it’s a key. JSON.stringify with it’s data goes to the scrypt as a password and that creates an AES-256-GCM key. There is no if, every other input won’t decrypt. That’s why no one will get payload from the package without knowing the exact input.

stymaar•about 2 hours ago

1. “The X is not Y, it's Z” 2. 3 months old account

Bad bot.

(I still wonder what these not operators have to gain in that process, but they sure want HN karma).

tranceylc•about 3 hours ago

I would assume it’s actually so they can allow it to spread before it gets activated. Then do something that affects the entire chain of package dependencies

nextzck•about 3 hours ago

Fascinating how intricate the target selection is on this

WorldMaker•about 2 hours ago

A lot of this seems to be a reminder that the CommonJS module format should just be left to die already. Not that you can't pull similar tricks with `await import()` in ESM, but you can't easily grep an entire dependency for dynamic `require()` half as easily as you can can `grep import\s*\(` for dynamic import and analysis tools for static `import` keyword are easy to use/build rather than no such thing for CommonJS.

Someone thought I was joking when I said I always check JSR before NPM now, because I trust ESM so much more than CommonJS.

fshafique•about 3 hours ago

Does the FBI or any other law-enforcement office follow up on these backdoors? Is this considered a crime, or even conspiracy to commit a crime, or is it only the act of using the backdoor that's a crime?

I can also see that it's still up in NPM without any warning of any kind: - https://www.npmjs.com/package/mathmain

But the Github repo for the package and the author are down: - https://github.com/allendev12 - https://github.com/allendev12/mathmain

altairprime•about 2 hours ago

> This package contained malicious code and was removed from the registry by the npm security team.

TZubiri•about 3 hours ago

My strategy of not using dependencies at all seems to be getting stronger everyday.

Also no LLM generated skipping this hypetrain completely. Just hand written code I can personally vouch for. Code in exchange for cash, this is professional business, Boss.

Btw, I'm available for hire, preferably by Pre Market Fit or pre-MVP startups, email in profile.

VorpalWay•about 2 hours ago

So, where do you draw the line? Do you accept having an OS? Because that is a huge dependency. So I assume you run directly on BIOS or UEFI? But even those are fairly sizable on modern systems.

iLoveOncall•about 3 hours ago

Let us know in 2838 when you finish your first program, would love to check it out!

zzril•about 3 hours ago

Had I found sthg like this, I'd be proud to tell everyone and certainly enjoy doing the writeup. But this smells like it was ai-written...

mavamaarten•about 2 hours ago

Yeah lots of weird emphasis on things a human wouldn't care about. And emphasis on what it isn't, rather than what it is. It's not Y, it's X. And there are two files!!!

altairprime•about 3 hours ago

> We found a remote access implant hidden inside [email protected], an npm package that copies the popular mathjs library.

The NPM package not named in the clickbait-y post title is “mathmain@1.0.0”, for those who run into this particular site obstacle; the later packages also named are “mathsbase” and “math-universe”. (EDIT: I see the submission title has been updated, so that’s my complaint addressed, thanks mods!)

Safedep, if you’re reading this, perhaps you should reconsider having that site feature applied to your post — or if it’s something you enabled in, say, Cloudflare, perhaps file a support ticket noting that their email protection is hiding package version strings.

QuantumNomad_•about 3 hours ago

Probably Cloudflare. For me it shows the package name rather than a redaction. But from memory, Cloudflare email protection redacts it that way in the HTML and then adds a little JS to put it back in which might also do some kind of check to see if it thinks you are a real user before unredacting it.