bs58-33

{"schema_version":"1.7.4","id":"MAL-2026-14017","published":"2026-08-13T00:00:00Z","modified":"2026-08-14T14:53:28.050137569Z","summary":"Malicious code in bs58-33 (npm)","details":"npm/bs58-33 is a typosquat of the popular bs58 base58 codec (cryptocoinjs). The package contains no malicious code of its own: its src/cjs/index.cjs simply does require(\"base65-33x\") and re-exports it. Its sole purpose is to pull in the malicious sink package base65-33x as a runtime dependency (declared dependency: base65-33x: ^5.0.1). base65-33x is a near-verbatim clone of base-x whose decode() exfiltrates every string passed to it by POSTing the raw input to a hardcoded bare-IP C2 (http://168.231.81.80:3002/api/log) before throwing; because base-x/bs58 are how crypto tooling base58-decodes private keys and seeds, the exfiltrated values are frequently secrets. The sink is reported separately as MAL-2026-13749. bs58-33 and its sibling wrappers (bs58-15, bs58-77) were published alongside the three base65 sinks by a single npm maintainer account (smallmantis) within a ~90-minute window on 2026-08-11, forming a matched six-package delivery-plus-exfiltration campaign. Installing bs58-33 is sufficient to introduce the key-exfiltration behavior into a dependent project.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6bc125c76d61a6185818bbd36ee2274b5cb5576b09b5d763b1c35571eec44989)\nThe package was found to contain malicious code or consuming dependency that contains malicious code\n","affected":[{"package":{"name":"bs58-33","ecosystem":"npm"},"versions":["6.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/cjs/index.cjs","sha256":"30ad6492aa2f4dbf16173efbcbbd631a2b53c90fd5d8d3ca4870767c815d3896","tlsh":"22e061577db7d4914264004e4225c8932ffd4c7f0484345a72cf9fbad25409568a1d17"}],"package_integrity":[{"filename":"bs58-33-6.0.1.tgz","hashes":{"sha1":"38694ca83d1253b3b310a5a2d85f4e9c0f4bf801","sha512_sri":"sha512-jcC9NjIPs2rq2zjBOFzr55eLGSzMcPW+AD1A3SVMnRNxpBxB1fGkZbDOK5/F5zONRAJgOuEkRDxaH39pwP9xHw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bs58-33"},{"type":"ADVISORY","url":"https://osv.dev/vulnerability/MAL-2026-13749"},{"type":"WEB","url":"https://pkgwarden.com/incidents/base65-npm-august-2026/"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/bs58-33/v/6.0.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017786","import_time":"2026-08-14T14:51:38.495144683Z","modified_time":"2026-08-14T14:36:04Z","sha256":"6bc125c76d61a6185818bbd36ee2274b5cb5576b09b5d763b1c35571eec44989","source":"amazon-inspector","versions":["6.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"pkgwarden","contact":["https://pkgwarden.com"],"type":"FINDER"}]}