Malicious npm packages impersonating math, event-emitter, mutex, graph and B-tree utility libraries. The payload is embedded in the library's runtime API rather than an install script, so it executes only when a consuming application calls a specific method with attacker-chosen input, then retrieves further instructions from an external service. Some affected packages have been removed from the npm registry; others remain published.