CVE
CVE-2026-94185, CVE-2025-39682, CVE-2026-53266, CVE-2025-39964
CWE
CWE-506, CWE-22, CWE-522, CWE-754, CWE-787, CWE-362
Affected Surface
- npm consumers that fetched mathmain 1.0.0, mathsbase 1.0.1, or math-universe 1.0.0 through 1.0.2 and later imported the package on developer hosts or CI runners
- Teams still running nvm 0.40.7 or earlier on developer workstations, CI runners, or shell setups that automatically trust repository .nvmrc files
- Linux workstations, runners, and shared hosts that still carry KEV-listed CVE-2025-39682, CVE-2026-53266, or CVE-2025-39964 after a first-stage compromise lands
- Organizations that installed PhantomRaven package names such as transform-jsbi-to-bigint or sort-imports-es6-autofix before registry cleanup
Welcome to Corgea’s weekly briefing. The briefing covers the most important security findings and research from the week.
This edition covers research published from Tuesday, 16 September through Tuesday, 22 September 2026, while skipping items that already made it into the 19 September briefing. That means the week still includes four useful Corgea articles even after we leave the earlier google-protobuf write-up in the prior roundup where it belongs.
Top Article
mathmain, mathsbase, and math-universe hid an encrypted loader behind lusolve()
The most important article in this Tuesday window is Corgea’s write-up on mathmain, mathsbase, and math-universe. JFrog’s reverse engineering, backed up by the parallel work from Very Serious Systems, turned a suspicious package cluster into something defenders can actually hunt: a tarball-only loader that waits for lusolve() to process the right matrix, derives an AES key from solver state, and only then decrypts the next stage.
That is what makes the case stand out. The package can still return a valid math result while using the same runtime path to unlock a Slack and Sepolia controlled implant. This is not an install-hook story, and it is not just another typosquat. It is a reminder that registry artifacts can stay dangerous even when the linked source repository looks ordinary.
If you are already tracking the broader npm malware wave, this article pairs well with Corgea’s earlier work on PhantomRaven’s URL dependency theft path and the registry-versus-source mismatch in @7nohe/openapi-react-query-codegen. The common lesson is simple: review the published artifact, not just the repository homepage.
More news
CVE-2026-94185: malicious .nvmrc values can make nvm read .npmrc, .aws/credentials, and other local files
The 21 September nvm article is the week’s clearest developer-tooling bug. GitHub published the advisory, and the nvm maintainers shipped 0.40.8 the same day. The flaw is not flashy, but it is easy to picture in a real team environment: a hostile .nvmrc can make nvm use, nvm install, or nvm which read files such as ~/.npmrc, ~/.aws/credentials, or ~/.git-credentials from the local machine.
It matters because the trigger is repository metadata rather than a hostile mirror. That makes it a useful companion to Corgea’s earlier CVE-2026-10796 nvm mirror command injection article. The older bug needed control of the download path. This one only needs a developer or CI runner to trust the repository they just entered.
CISA moved three Linux kernel CVEs into KEV
CISA gets the credit here for changing the priority, not by discovering the bugs, but by moving CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 into KEV on 18 September. That update turned three older Linux kernel issues into immediate triage items for developer workstations, shared Linux hosts, and self-hosted runners that may already have a first-stage compromise.
The most actionable part of the set is still CVE-2026-53266, because the bridge ebtables SNAT rewrite path is the easiest one to map to a host-boundary problem. But the article is worth reading as a group update. If you have been following Corgea’s earlier Linux research on Dirty Frag, SCTPhantom, or CVE-2026-53362, this is the current KEV checkpoint.
Other news
- PhantomRaven on npm:
transform-jsbi-to-bigintandsort-imports-es6-autofixhid credential theft behind URL dependencies still belongs in this week’s mailer because it was published on 16 September and did not make the previous roundup. CrowdStrike tied the two package names to real compromises, while the article also credits earlier Endor Labs work that explained the Remote Dynamic Dependencies pattern behind the campaign. - If you are catching up on adjacent coverage from the same stretch of September, the closest Corgea follow-ons are the prior 19 September briefing, the stand-alone google-protobuf DoS article, and the earlier
nvmtrust-boundary failure in CVE-2026-10796.
From research to remediation
Check whether this pattern exists in your codebase
Turn this research into a remediation workflow. Scan dependencies and package manifests for similar supply-chain risk, then prioritize fixes with reachability context.