base58-utils

{"modified":"2026-07-14T18:30:27Z","published":"2026-07-14T17:47:22Z","schema_version":"1.7.4","id":"MAL-2026-10606","summary":"Malicious code in base58-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ba5517883cb10a7c76e95fdf21a4ffce21c13fe1ca42fafc13f5adb021599772)\nThe package's index.js contains multiple Buffer.from(...) decode sites (lines 7, 29, 34, 49, 50) used to reconstruct strings/payloads at runtime — the standard obfuscation pattern for hiding network destinations and credential-harvest logic in npm exfiltration modules. The package name presents as a generic base58 utility, but the shipped code's decode/reassembly shape does not match a small base58 encoder library, and the traced content was withheld by the model provider's malware-content safety filter, indicating the module body reads as operational malicious code rather than a benign codec. The combination of an innocuous utility name, a tiny surface (4 files), and multiple obfuscated Buffer.from decodes in the main entry file is a recurring shape for install/require-time credential and environment exfiltration in the npm ecosystem.\n","affected":[{"package":{"ecosystem":"npm","name":"base58-utils"},"versions":["1.0.3","1.0.5","1.0.4","1.0.0","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"fd523dcafc7e9ddb24cbd0e89f07ab97aa3c25043eb3f8d17f120b28aafbbb33","tlsh":"d361b5991bf67350821f7058896bc8057afde1013908c99cfe8d61820f20d788bfbaed"}],"package_integrity":[{"filename":"base58-utils-1.0.3.tgz","hashes":{"sha1":"45c068166337aa788d5ebedca11a59437de43f23","sha512_sri":"sha512-EK3ApIci1D92iJ2inG+QycC833+NcXf7coOr8eDWP24xozSBUjox2UVwvzyXb2Lobd1dqPEOjGGOo8QmulIbBQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/base58-utils/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/base58-utils/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/base58-utils/v/1.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/base58-utils/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/base58-utils/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010529","import_time":"2026-07-14T18:28:26.229397818Z","modified_time":"2026-07-14T17:47:48Z","sha256":"34f54e86ffeb2667a7cef8dd34d8693c007d696a19041a5967f9281eaf99d346","source":"amazon-inspector","versions":["1.0.3"]},{"id":"IN-MAL-2026-010526","import_time":"2026-07-14T18:28:25.840961581Z","modified_time":"2026-07-14T17:47:22Z","sha256":"ec6be77583a4d5fdb28420c0c596ace10d664766fe81976a66b99dff674703f4","source":"amazon-inspector","versions":["1.0.5"]},{"id":"IN-MAL-2026-010530","import_time":"2026-07-14T18:28:26.335422331Z","modified_time":"2026-07-14T17:47:55Z","sha256":"fadb3ffd853509cd69312b57da13b6e2bcd85615f65b0526116c456a70de47d4","source":"amazon-inspector","versions":["1.0.4"]},{"id":"IN-MAL-2026-010527","import_time":"2026-07-14T18:28:25.946424062Z","modified_time":"2026-07-14T17:47:30Z","sha256":"3562adad8a56b743ca4e66c56ef40e012fe89078d25e2d773167c4f5a157b006","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-010528","import_time":"2026-07-14T18:28:26.086050019Z","modified_time":"2026-07-14T17:47:41Z","sha256":"ba5517883cb10a7c76e95fdf21a4ffce21c13fe1ca42fafc13f5adb021599772","source":"amazon-inspector","versions":["1.0.1"]}]}}