MAL-2026-10606

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/base58-utils/MAL-2026-10606.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10606
Published
2026-07-14T17:47:22Z
Modified
2026-07-14T18:49:32Z
Summary
Malicious code in base58-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ba5517883cb10a7c76e95fdf21a4ffce21c13fe1ca42fafc13f5adb021599772)

The package's index.js contains multiple Buffer.from(...) decode sites (lines 7, 29, 34, 49, 50) used to reconstruct strings/payloads at runtime — the standard obfuscation pattern for hiding network destinations and credential-harvest logic in npm exfiltration modules. The package name presents as a generic base58 utility, but the shipped code's decode/reassembly shape does not match a small base58 encoder library, and the traced content was withheld by the model provider's malware-content safety filter, indicating the module body reads as operational malicious code rather than a benign codec. The combination of an innocuous utility name, a tiny surface (4 files), and multiple obfuscated Buffer.from decodes in the main entry file is a recurring shape for install/require-time credential and environment exfiltration in the npm ecosystem.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010529",
            "import_time": "2026-07-14T18:28:26.229397818Z",
            "modified_time": "2026-07-14T17:47:48Z",
            "sha256": "34f54e86ffeb2667a7cef8dd34d8693c007d696a19041a5967f9281eaf99d346",
            "source": "amazon-inspector",
            "versions": [
                "1.0.3"
            ]
        },
        {
            "id": "IN-MAL-2026-010526",
            "import_time": "2026-07-14T18:28:25.840961581Z",
            "modified_time": "2026-07-14T17:47:22Z",
            "sha256": "ec6be77583a4d5fdb28420c0c596ace10d664766fe81976a66b99dff674703f4",
            "source": "amazon-inspector",
            "versions": [
                "1.0.5"
            ]
        },
        {
            "id": "IN-MAL-2026-010530",
            "import_time": "2026-07-14T18:28:26.335422331Z",
            "modified_time": "2026-07-14T17:47:55Z",
            "sha256": "fadb3ffd853509cd69312b57da13b6e2bcd85615f65b0526116c456a70de47d4",
            "source": "amazon-inspector",
            "versions": [
                "1.0.4"
            ]
        },
        {
            "id": "IN-MAL-2026-010527",
            "import_time": "2026-07-14T18:28:25.946424062Z",
            "modified_time": "2026-07-14T17:47:30Z",
            "sha256": "3562adad8a56b743ca4e66c56ef40e012fe89078d25e2d773167c4f5a157b006",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-010528",
            "import_time": "2026-07-14T18:28:26.086050019Z",
            "modified_time": "2026-07-14T17:47:41Z",
            "sha256": "ba5517883cb10a7c76e95fdf21a4ffce21c13fe1ca42fafc13f5adb021599772",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / base58-utils

Package

Name
base58-utils
View open source insights on deps.dev
Purl
pkg:npm/base58-utils

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.3
1.0.4
1.0.5

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "fd523dcafc7e9ddb24cbd0e89f07ab97aa3c25043eb3f8d17f120b28aafbbb33",
            "tlsh": "d361b5991bf67350821f7058896bc8057afde1013908c99cfe8d61820f20d788bfbaed"
        }
    ],
    "package_integrity": [
        {
            "filename": "base58-utils-1.0.3.tgz",
            "hashes": {
                "sha1": "45c068166337aa788d5ebedca11a59437de43f23",
                "sha512_sri": "sha512-EK3ApIci1D92iJ2inG+QycC833+NcXf7coOr8eDWP24xozSBUjox2UVwvzyXb2Lobd1dqPEOjGGOo8QmulIbBQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/base58-utils/MAL-2026-10606.json"