The [email protected] package is a typosquatting repackage of the legitimate ml-matrix library, designed to deceive users. Its main module routes input to a function that, upon matching a hardcoded SHA-256 hash, decrypts an AES-256-GCM encrypted payload containing an Ethereum wallet SDK and other encrypted blobs. This payload is written to a temporary file and executed in a detached, hidden Node.js process. The presence of crypto-related code and encrypted payloads in a package advertised for matrix computations strongly suggests it is malware targeting crypto wallets. Any downstream application invoking solve() on attacker-controlled input risks executing this malicious payload.

Execution of the malicious payload can lead to unauthorized code running on the end-user's system, potentially compromising Ethereum wallets and related cryptographic assets. This can result in theft of cryptocurrency or further system compromise. The attack is triggered by calling the solve() function with specific input, making any application using this package vulnerable if it processes untrusted input.

No official patch or remediation is currently available. Users and developers should immediately remove [email protected] from their projects and replace it with the legitimate ml-matrix package. Avoid invoking the solve() function on untrusted input. Monitor dependencies carefully to prevent typosquatting packages from being introduced. Check vendor advisories or trusted sources for updates on remediation.