> We found a remote access implant hidden inside [email protected], an npm package that copies the popular mathjs library. The NPM package not named in the cli

> We found a remote access implant hidden inside [email protected], an npm package that copies the popular mathjs library. The NPM package not named in the clickbait-y post title is “mathmain@1.0.0”, for those who run into this particular site obstacle. Safedep, if you’re reading this, perhaps you should reconsider having that site feature applied to your post — or if it’s something you enabled in, say, Cloudflare, perhaps file a support ticket noting that their email protection is hiding package version strings.