Equation of Compromise: Anatomy of a Live npm Supply-Chain Campaign
A six-month sophisticated campaign targeted quantitative and DeFi developers by distributing malicious npm packages masquerading as legitimate mathematics libraries. The campaign uses encrypted loaders that activate only during specific cryptographic operations, such as solving linear equations with certain matrices. Command and control is conducted via Ethereum Sepolia testnet smart contracts and a secondary Slack channel, enabling encrypted tasking of compromised systems. The threat actors inflated download counts using GitHub Actions workers to build false credibility. Fourteen smart contracts across five wallets managed over 1,000 encrypted taskings. The operation shows advanced operational security including disposable accounts, ephemeral key encryption, and infection markers hidden in license files.
AI Analysis
Technical Summary
This campaign involves malicious npm packages targeting developers in quantitative and decentralized finance (DeFi) sectors. The malicious code employs encrypted loaders that trigger only when specific cryptographic computations are performed, specifically solving linear equations with predetermined matrices. The attackers use Ethereum Sepolia testnet smart contracts as dead drop points for command and control, supplemented by a Slack channel for encrypted communication. To establish legitimacy, the actors generated millions of fake downloads using GitHub Actions workers. The infrastructure includes fourteen smart contracts deployed across five operator wallets, managing over 1,000 encrypted taskings to victims. The campaign demonstrates high operational security with disposable accounts, encrypted payloads sealed with ephemeral keys, and infection markers concealed in license files.
Potential Impact
The campaign compromises systems of quantitative and DeFi developers through supply-chain attacks on npm packages, potentially enabling unauthorized encrypted tasking and control of infected systems. The use of encrypted loaders and blockchain-based command and control infrastructure complicates detection and attribution. The fake download inflation may mislead users into trusting malicious packages, increasing infection risk. No known exploits in the wild are reported, but the campaign's sophistication and targeting pose a medium risk to affected developer communities.
Mitigation Recommendations
No official patch or remediation is indicated. Defenders should be aware of this campaign and scrutinize npm packages, especially those related to mathematics libraries used in quantitative and DeFi development. Monitoring for suspicious package behavior, verifying package provenance, and limiting use of untrusted packages are recommended. Since the campaign uses advanced evasion techniques, enhanced supply-chain security practices and threat intelligence sharing are advised. No vendor advisory or official fix is currently available; patch status is not yet confirmed—check vendor advisories for updates.
Indicators of Compromise
- hash: 91e020c13cb97a6365135b53b0d0fe5f
- hash: d3d6e819028346a0b973bd5dd371c468
- hash: dc7257d09fab42eca2c354c32fec1938
Equation of Compromise: Anatomy of a Live npm Supply-Chain Campaign
Description
A six-month sophisticated campaign targeted quantitative and DeFi developers by distributing malicious npm packages masquerading as legitimate mathematics libraries. The campaign uses encrypted loaders that activate only during specific cryptographic operations, such as solving linear equations with certain matrices. Command and control is conducted via Ethereum Sepolia testnet smart contracts and a secondary Slack channel, enabling encrypted tasking of compromised systems. The threat actors inflated download counts using GitHub Actions workers to build false credibility. Fourteen smart contracts across five wallets managed over 1,000 encrypted taskings. The operation shows advanced operational security including disposable accounts, ephemeral key encryption, and infection markers hidden in license files.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This campaign involves malicious npm packages targeting developers in quantitative and decentralized finance (DeFi) sectors. The malicious code employs encrypted loaders that trigger only when specific cryptographic computations are performed, specifically solving linear equations with predetermined matrices. The attackers use Ethereum Sepolia testnet smart contracts as dead drop points for command and control, supplemented by a Slack channel for encrypted communication. To establish legitimacy, the actors generated millions of fake downloads using GitHub Actions workers. The infrastructure includes fourteen smart contracts deployed across five operator wallets, managing over 1,000 encrypted taskings to victims. The campaign demonstrates high operational security with disposable accounts, encrypted payloads sealed with ephemeral keys, and infection markers concealed in license files.
Potential Impact
The campaign compromises systems of quantitative and DeFi developers through supply-chain attacks on npm packages, potentially enabling unauthorized encrypted tasking and control of infected systems. The use of encrypted loaders and blockchain-based command and control infrastructure complicates detection and attribution. The fake download inflation may mislead users into trusting malicious packages, increasing infection risk. No known exploits in the wild are reported, but the campaign's sophistication and targeting pose a medium risk to affected developer communities.
Defensive Guidance
No official patch or remediation is indicated. Defenders should be aware of this campaign and scrutinize npm packages, especially those related to mathematics libraries used in quantitative and DeFi development. Monitoring for suspicious package behavior, verifying package provenance, and limiting use of untrusted packages are recommended. Since the campaign uses advanced evasion techniques, enhanced supply-chain security practices and threat intelligence sharing are advised. No vendor advisory or official fix is currently available; patch status is not yet confirmed—check vendor advisories for updates.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://research.jfrog.com/post/equation-of-compromise/"]
- Pulse Id
- 6ab22e89f1e0c549443c6917
Indicators of Compromise
Hash
| Value | Description | Copy |
|---|---|---|
hash91e020c13cb97a6365135b53b0d0fe5f | — | |
hashd3d6e819028346a0b973bd5dd371c468 | — | |
hashdc7257d09fab42eca2c354c32fec1938 | — |
Threat ID: 6ab23631f7a7c54106e03199
Added to database: 09/22/2026, 08:02:57 UTC
Last enriched: 09/22/2026, 08:20:10 UTC
Last updated: 09/22/2026, 16:30:19 UTC
Views: 30
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.