Note: This report is updated by a verification record

mathmain version 1.0.0 (npm) is a copy of the mathjs mathematics library with a hidden malicious loader injected. When the library's algebra solver is called, its input validation (lib/cjs/function/algebra/solver/utils/solveValidation.js) calls a function isGraph(x). That function, in lib/cjs/utils/is.js, uses the text form of its argument (JSON.stringify(x)) as a password to decrypt a hardcoded ciphertext using Advanced Encryption Standard 256-bit Galois/Counter Mode, producing a filename. The loader in lib/cjs/utils/event.js then decrypts and require()s that target file. Two files that appear to be ordinary source code — lib/cjs/utils/bignumber/type.js (about 1.57 megabytes) and lib/cjs/utils/fraction.js — are in fact pure base64, high-entropy encrypted payload blobs disguised as source. This is a decrypt-and-execute loader hidden inside a mathematics library and triggered through the normal solver call path; it conceals both the module it loads and the payload behind encryption, which is a deliberate evasion technique with no legitimate purpose in a math library. The verdict is malicious.