MAL-2026-13964

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bs58-15/MAL-2026-13964.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13964
Published
2026-08-13T00:00:00Z
Modified
2026-08-14T06:15:12.315205Z
Summary
Malicious code in bs58-15 (npm)
Details

npm/bs58-15 is a typosquat of the popular bs58 base58 codec (cryptocoinjs). The package contains no malicious code of its own: its src/cjs/index.cjs simply does require("base65-15x") and re-exports it. Its sole purpose is to pull in the malicious sink package base65-15x as a runtime dependency (declared dependency: base65-15x: ^5.0.1). base65-15x is a near-verbatim clone of base-x whose decode() exfiltrates every string passed to it by POSTing the raw input to a hardcoded bare-IP C2 (http://46.250.253.63:3000/api/log) before throwing; because base-x/bs58 are how crypto tooling base58-decodes private keys and seeds, the exfiltrated values are frequently secrets. The sink is reported separately as MAL-2026-13748. bs58-15 and its sibling wrappers (bs58-33, bs58-77) were published alongside the three base65 sinks by a single npm maintainer account (smallmantis) within a ~90-minute window on 2026-08-11, forming a matched six-package delivery-plus-exfiltration campaign. Installing bs58-15 is sufficient to introduce the key-exfiltration behavior into a dependent project.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (99502d2feb4743e651628a07ca032fa0cc813ff6482cae15d9c2f1fb6fce63c4)

Package name 'bs58-15' impersonates the widely-used 'bs58' base58 encoding library, and its package.json metadata (repository, homepage, bugs) points at the legitimate cryptocoinjs/bs58 project despite being published by an unrelated author, presenting false provenance. The package's single runtime dependency is 'base65-15x', a lookalike of the legitimate 'base-x' package. The main entry executes require("base65-15x") and immediately invokes the returned value as a function against an alphabet constant on module load, so any consumer that installs bs58-15 and requires it pulls attacker-named dependency code into their dependency graph and executes it at import time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017667",
            "import_time": "2026-08-13T20:49:27.433264424Z",
            "sha256": "99502d2feb4743e651628a07ca032fa0cc813ff6482cae15d9c2f1fb6fce63c4",
            "modified_time": "2026-08-13T20:36:26Z",
            "source": "amazon-inspector",
            "versions": [
                "6.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bs58-15

Package

Name
bs58-15
View open source insights on deps.dev
Purl
pkg:npm/bs58-15

Affected ranges

Affected versions

6.*
6.0.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "src/cjs/index.cjs",
            "tlsh": "dee0615a7db7d5914664004e4325c8932efd4c7f0484345a72cf9fbad25409568a1d27",
            "sha256": "af91c74168160207f1c21d89892e6def9b0ef81342c383faeb3e90c1936adaf0"
        },
        {
            "path": "package.json",
            "tlsh": "d5319959d8b84d6317c5a1a499795a13e6350d8b8818fc5e73ee422c8f8c17f01fd2ed",
            "sha256": "2fcb29a04147a517d327d58eecbe379feef96a1b6d55c094991b87d0e58307f3"
        }
    ],
    "package_integrity": [
        {
            "filename": "bs58-15-6.0.1.tgz",
            "hashes": {
                "sha1": "6908dad51bf8bb28ed0d1b51cd758cca07dec009",
                "sha512_sri": "sha512-owB5f6xDKn0wpyeEjd9HOXb/u9WTeBweeowfVeN25mHz+da8ARHiJ4n6NDHeVQRB1hsrTZs/q1uF6v9ecW8+Kw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bs58-15/MAL-2026-13964.json"