Supply chain · npm · High

Critical Malware in npm Package @jaime9008/math-service

Threat Engine Auto-Feed · data current as of 2026-07-06

The npm package `@jaime9008/math-service` version 1.0.0 contains malware, leading to full system compromise upon installation. All secrets and keys on affected systems should be immediately rotated, and the package removed, though full remediation may require further action due to potential persistent compromise.

  • Package: npm / @jaime9008/math-service
  • Affected versions: = 1.0.0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The npm package `@jaime9008/math-service` version 1.0.0 has been identified as malicious. Installation of this package results in a full compromise of the host system, enabling potential credential and secret theft.

How the attack works

This is a supply-chain attack where a malicious software package is introduced into a public registry. When developers or automated systems install this package, the embedded malware executes, compromising the host system. The specific mechanism of compromise is not detailed, but the outcome is full control of the affected computer.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • CI/CD pipelines that install npm dependencies
  • Any organization whose build systems or developer workstations pulled version 1.0.0 of this package

Conditions that increase exposure

  • Unpinned dependencies allowing automatic updates to malicious versions
  • Lack of package lockfiles (e.g., package-lock.json) to ensure consistent dependency resolution
  • Internal package mirrors that do not vet upstream packages for malicious content

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, further network penetration, or deployment of additional malware.
  • All secrets, API keys, and credentials stored on the compromised computer are at risk of theft.
  • The blast radius extends to any systems that interact with the compromised machine or use credentials stolen from it.

What to do (defensive)

Detect

  • Scan dependency trees for `@jaime9008/math-service` version 1.0.0.
  • Review build logs and package installation histories for evidence of the package being pulled.
  • Monitor for unusual network activity or unauthorized access attempts from systems that may have installed the package.

Contain

  • Immediately isolate any systems identified as having installed `@jaime9008/math-service` version 1.0.0.
  • Block `@jaime9008/math-service` version 1.0.0 from being downloaded or installed in your environment.
  • Implement strict dependency pinning and use lockfiles to prevent unintended package updates.

Remediate

  • Consider any computer that installed `@jaime9008/math-service` version 1.0.0 to be fully compromised.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, access tokens) that were stored on or accessible from the compromised computer, performing this action from a different, trusted system.
  • Remove the malicious package. However, be aware that full control may have been given to an attacker, and complete eradication may require re-imaging the compromised system or further forensic analysis to ensure all malicious components are removed.

Frontier verdict — High

Prioritize immediate rotation of all secrets and isolation of any systems that installed `@jaime9008/math-service` version 1.0.0 due to critical system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.