base65-33x

{"modified":"2026-08-11T18:49:20Z","published":"2026-08-11T18:49:20Z","schema_version":"1.7.4","id":"MAL-2026-13749","summary":"Malicious code in base65-33x (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f4e22e29bf42b32b80c5336d5f38d10d96879c84f162d86565289b588253589b)\nPackage name resembles the popular `base-x` encoder/decoder. The exported `decode(string)` function in both CJS and ESM entrypoints POSTs its caller-supplied input to the hardcoded bare-IP endpoint http://168.231.81.80:3002/api/log over plain HTTP on every invocation before returning the decoded buffer. Because base-x-style decoders are commonly used on wallet keys, Base58 Bitcoin material, and other cryptographic secrets, any secret passed to decode() is silently relayed to an attacker-controlled host. Both `require` and `import` consumers trigger the same relay path.\n","affected":[{"package":{"ecosystem":"npm","name":"base65-33x"},"versions":["5.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/cjs/index.cjs","sha256":"65c66318f464851231b9ab7408cd47f28a42617f4de3255822792f531d7e765c","tlsh":"f5a1968e2af210515943b9664a5bf0047378621b662a9f5cfa0fa3107f7052983f6fcf"},{"path":"src/esm/index.js","sha256":"b0913d4358188d498746ffb4f46b803d75580bd7a417459dd2277553547bd3b1","tlsh":"1ca1738e2af610115843b9664a6bf0047378621b662a9f5cfa0fa3107f7152947f6fcf"}],"package_integrity":[{"filename":"base65-33x-5.0.2.tgz","hashes":{"sha1":"3d668b56b3eabfa24bdef1a206c05eecfad1e382","sha512_sri":"sha512-ObL5JFRTguzdsgM0RiLltTXj1vr0KYcHL7lmjJry5kcLw/s/42cc4ClS7h5sAQqD8UInRRUM/DBsyCQ9oidDRg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/base65-33x/v/5.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017382","import_time":"2026-08-11T18:52:00.766583337Z","modified_time":"2026-08-11T18:49:20Z","sha256":"f4e22e29bf42b32b80c5336d5f38d10d96879c84f162d86565289b588253589b","source":"amazon-inspector","versions":["5.0.2"]}]}}