Why in the world would that specific 3x3 matrix be a trigger for an attack? Are they trying to find someone doing some particular kind of numerical analysis?

Presumably it's so it can be used as a subdependency for setting up an attack in a popular, legitimate package, e.g. via a pull request. The code in the legitimate package would not arouse suspicion at all.

Perhaps they just need a way to sneakily activate it? Or perhaps they have a target application which they know uses that. This method suggests a supply chain attack where a valid contributor to a library 'accidentally' includes this package and the hack carries out before anyone notices.

My guess is that it's crypto related but of course it could be anything.

I would assume it’s actually so they can allow it to spread before it gets activated. Then do something that affects the entire chain of package dependencies

This matrix is not a condition, it’s a key. JSON.stringify with it’s data goes to the scrypt as a password and that creates an AES-256-GCM key. There is no if, every other input won’t decrypt. That’s why no one will get payload from the package without knowing the exact input.

A status code for (industrial/the-man) equipment? You could target specific environments by activating on obscure error codes that can be remotely triggered.

Aka If someone from the outside can make your equipment emit X internally, they can target X in some way.