Equation of Compromise: Anatomy of a Live npm Supply-Chain Campaign

A sophisticated six-month campaign targeting quantitative and DeFi developers through malicious npm packages disguised as legitimate mathematics libraries. The operation employs encrypted loaders that trigger only when specific cryptographic operations are performed, specifically when solving linear equations with predetermined matrices. Command and control infrastructure uses Ethereum Sepolia testnet smart contracts as dead drops, alongside a secondary Slack channel, enabling encrypted tasking of compromised systems. The threat actors manufactured millions of fake downloads using GitHub Actions workers to establish false credibility. Fourteen smart contracts were deployed across five operator wallets, managing over 1,000 encrypted taskings to enrolled victims. The campaign demonstrates advanced operational security with disposable accounts, encrypted payloads sealed under ephemeral keys, and infection markers hidden in license files.

• DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructureMalware2026-08-10
• WebAssembly Malware Found in Trojanized Open VSX ExtensionsMalware2026-06-16
• Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code RepositoriesMalware2026-04-21
• Fake recruiter campaign targets crypto developers with RATMalware2026-04-13