JFrog uncovers 'Equation of Compromise', a targeted npm campaign hiding in a mathjs look-alike

On 21 September 2026 the JFrog Security Research team published an analysis of a malicious npm campaign it calls “Equation of Compromise”. The researchers connected several incidents that first looked unrelated and showed they were run by the same operators, using fake popularity to get developers to install trojanised maths and DeFi libraries.

What changed

• A copycat package as the entry point. The campaign started with mathsbase, a renamed copy of the widely used mathjs library. Version 1.0.1 appeared on 27 August 2026 and, according to JFrog, showed roughly six million downloads two days later even though no other package depended on it.
• Downloads bought, not earned. JFrog traced the inflated numbers to a download farm of 30 public GitHub repositories spread across three accounts, each fetching target packages on a schedule.
• Malware that waits for the right victim. The hidden code stays dormant unless a developer runs one specific matrix calculation, so the package behaves normally in most tests. JFrog reads this as a targeted operation, and judging by the lures it believes the intended victims are developers doing quantitative and DeFi work, possibly reached through an interview-style task.
• Unusual command channels. Once triggered, the implant sends basic system details to a Slack channel and a Telegram chat, and looks up its instructions in smart contracts on blockchain test networks. JFrog counted fourteen such contracts. The second-stage payloads are encrypted and the researchers say they could not decrypt any of them, so the final goal is unknown.
• Detection. JFrog states that customers using Xray and Curation can detect and block the listed packages. The post also includes indicators of compromise for security teams.

What it means for buyers in South Africa and Africa

Developers often judge a package by its weekly download count. This campaign shows that number can be manufactured. JFrog’s suggested red flag is a package with very high downloads but no dependent packages or repositories.

For organisations in the region, especially banks, fintechs and software houses that build on npm, the practical lessons are:

1. Route developer and CI/CD package downloads through a controlled repository instead of the public registry directly.
2. Add malicious-package detection and a curation policy that blocks new or suspicious packages before they reach a laptop or build agent.
3. Search your codebases and lockfiles for the packages and file names in JFrog’s indicator list, and rotate credentials on any machine that ran them.
4. Treat freshly published packages with inflated popularity as untrusted until reviewed.

These controls are licensed per vendor, typically in USD, and can be procured in USD or ZAR.

To see how a curated, scanned package flow works in practice, read about JFrog software supply chain security or JFrog Xray.