MAL-2026-14017

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bs58-33/MAL-2026-14017.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14017
Published
2026-08-13T00:00:00Z
Modified
2026-08-14T15:00:52.558562004Z
Summary
Malicious code in bs58-33 (npm)
Details

npm/bs58-33 is a typosquat of the popular bs58 base58 codec (cryptocoinjs). The package contains no malicious code of its own: its src/cjs/index.cjs simply does require("base65-33x") and re-exports it. Its sole purpose is to pull in the malicious sink package base65-33x as a runtime dependency (declared dependency: base65-33x: ^5.0.1). base65-33x is a near-verbatim clone of base-x whose decode() exfiltrates every string passed to it by POSTing the raw input to a hardcoded bare-IP C2 (http://168.231.81.80:3002/api/log) before throwing; because base-x/bs58 are how crypto tooling base58-decodes private keys and seeds, the exfiltrated values are frequently secrets. The sink is reported separately as MAL-2026-13749. bs58-33 and its sibling wrappers (bs58-15, bs58-77) were published alongside the three base65 sinks by a single npm maintainer account (smallmantis) within a ~90-minute window on 2026-08-11, forming a matched six-package delivery-plus-exfiltration campaign. Installing bs58-33 is sufficient to introduce the key-exfiltration behavior into a dependent project.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6bc125c76d61a6185818bbd36ee2274b5cb5576b09b5d763b1c35571eec44989)

The package was found to contain malicious code or consuming dependency that contains malicious code

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017786",
            "import_time": "2026-08-14T14:51:38.495144683Z",
            "sha256": "6bc125c76d61a6185818bbd36ee2274b5cb5576b09b5d763b1c35571eec44989",
            "versions": [
                "6.0.1"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-14T14:36:04Z"
        }
    ]
}
References
Credits

Affected packages

npm / bs58-33

Package

Name
bs58-33
View open source insights on deps.dev
Purl
pkg:npm/bs58-33

Affected ranges

Affected versions

6.*
6.0.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "src/cjs/index.cjs",
            "tlsh": "22e061577db7d4914264004e4225c8932ffd4c7f0484345a72cf9fbad25409568a1d17",
            "sha256": "30ad6492aa2f4dbf16173efbcbbd631a2b53c90fd5d8d3ca4870767c815d3896"
        }
    ],
    "package_integrity": [
        {
            "filename": "bs58-33-6.0.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-jcC9NjIPs2rq2zjBOFzr55eLGSzMcPW+AD1A3SVMnRNxpBxB1fGkZbDOK5/F5zONRAJgOuEkRDxaH39pwP9xHw==",
                "sha1": "38694ca83d1253b3b310a5a2d85f4e9c0f4bf801"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bs58-33/MAL-2026-14017.json"