MAL-2026-13748

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/base65-15x/MAL-2026-13748.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13748
Published
2026-08-11T18:49:11Z
Modified
2026-08-11T19:00:12.801822875Z
Summary
Malicious code in base65-15x (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (00fcb69b2f5c7e64ede8df36e3865dad82632ef076c6c2974b568727ec046062)

base65-15x is a typosquat of the base-x package. Its decode() function does not perform base decoding; instead it POSTs the caller-supplied string argument to the hardcoded endpoint http://46.250.253.63:3000/api/log over plain HTTP and then throws. Both the CommonJS entry and the ESM build (src/esm/index.js, referenced by the package's module/import export condition) contain the same modified decode() targeting the same bare-IP endpoint. Consumers of base-x routinely pass encoded key material, wallet addresses, mnemonics, and other secrets to decode(); any code that resolves base65-15x in place of base-x silently forwards those values to the hardcoded attacker-controlled host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017381",
            "import_time": "2026-08-11T18:52:00.616886553Z",
            "sha256": "00fcb69b2f5c7e64ede8df36e3865dad82632ef076c6c2974b568727ec046062",
            "modified_time": "2026-08-11T18:49:11Z",
            "source": "amazon-inspector",
            "versions": [
                "5.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / base65-15x

Package

Name
base65-15x
View open source insights on deps.dev
Purl
pkg:npm/base65-15x

Affected ranges

Affected versions

5.*
5.0.2

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "src/cjs/index.cjs",
            "tlsh": "46a1a68e2af611105843b9664a5bf0047378621b662a9f5cfa0fa3107f7052943f6fcf",
            "sha256": "97704a8553c321c030b04c25903c79be385f7455ef9edcf6fbeef38089994ea6"
        },
        {
            "path": "src/esm/index.js",
            "tlsh": "5c91848e2af611106843b9664a5be0047378621b662a9f5cfa0fa3107f7052943f6fcf",
            "sha256": "3be123ac6db00bd9c36edb73babd313cf39609bc0b629bc73fd397bd1c52a2cc"
        }
    ],
    "package_integrity": [
        {
            "filename": "base65-15x-5.0.2.tgz",
            "hashes": {
                "sha512_sri": "sha512-9mu2JDrADLII9A/jtMPEtn57bYrkQawSk214yXs4ARlqyLB/cfjacak/+5m6w+czJmO833LoFVczqvbjeikt/g==",
                "sha1": "f64fba72381237abfde44bf11c332e0db53e7d6a"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/base65-15x/MAL-2026-13748.json"