Critical Malicious Code Vulnerability in mathmain Package
Summary
MAL-2026-16368: Malicious code in mathmain (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mathmain package is an npm library designed for mathematical computations and operations. It is widely used in various applications that require mathematical functionalities. However, this package has been compromised, leading to severe security risks for any system utilizing it. The malicious code embedded within can potentially give unauthorized access to sensitive information and system controls.
Vulnerability Detail
The vulnerability originates from the presence of malicious code within the mathmain package, identified as GHSA-v6mx-2p6p-3628. Any system running this package is considered fully compromised, with the potential for attackers to access all secrets and keys stored on the machine. The malicious code can lead to data breaches, unauthorized access, and complete control over the affected systems. Users are advised to treat any system with this package installed as compromised and take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall mathmainIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability. The only recommended action is to remove the mathmain package entirely from your system.
Conclusion
The mathmain package has been compromised with malicious code, posing significant risks to any system using it. Users must act swiftly to remove the package and secure their sensitive information. Regular monitoring for vulnerabilities, such as through Vulert, can help prevent future incidents.
See every vulnerability recorded for mathmain →
FAQ
Immediately remove the mathmain package from your system and rotate any sensitive information stored on it.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Currently, there is no patched version available. The best course of action is to remove the package.
Failing to remove mathmain can lead to unauthorized access to your system, data breaches, and potential control by malicious actors.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file, providing real-time insights.
