MAL-2026-14018

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bs58-77/MAL-2026-14018.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14018
Published
2026-08-13T00:00:00Z
Modified
2026-08-14T15:00:53.254614569Z
Summary
Malicious code in bs58-77 (npm)
Details

npm/bs58-77 is a typosquat of the popular bs58 base58 codec (cryptocoinjs). The package contains no malicious code of its own: its src/cjs/index.cjs simply does require("base65-77x") and re-exports it. Its sole purpose is to pull in the malicious sink package base65-77x as a runtime dependency (declared dependency: base65-77x: ^5.0.1). base65-77x is a near-verbatim clone of base-x whose decode() exfiltrates every string passed to it by POSTing the raw input to a hardcoded bare-IP C2 (http://46.250.253.63:3000/api/log) before throwing; because base-x/bs58 are how crypto tooling base58-decodes private keys and seeds, the exfiltrated values are frequently secrets. The sink is reported separately as MAL-2026-13750. bs58-77 and its sibling wrappers (bs58-15, bs58-33) were published alongside the three base65 sinks by a single npm maintainer account (smallmantis) within a ~90-minute window on 2026-08-11, forming a matched six-package delivery-plus-exfiltration campaign. Installing bs58-77 is sufficient to introduce the key-exfiltration behavior into a dependent project.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b115b88f23da3c8c4256b2d15d8766695ddadde12e884e1c36c36440b4652ba7)

The package was found to contain malicious code or consuming dependency that contains malicious code

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017787",
            "import_time": "2026-08-14T14:51:38.556245146Z",
            "sha256": "b115b88f23da3c8c4256b2d15d8766695ddadde12e884e1c36c36440b4652ba7",
            "versions": [
                "6.0.1"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-14T14:36:12Z"
        }
    ]
}
References
Credits

Affected packages

npm / bs58-77

Package

Name
bs58-77
View open source insights on deps.dev
Purl
pkg:npm/bs58-77

Affected ranges

Affected versions

6.*
6.0.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "bs58-77-6.0.1.tgz",
            "hashes": {
                "sha1": "0201e6c021b382e3817c3ee01bbea3feb7a9e56c",
                "sha512_sri": "sha512-arJN3rvYltk3Fgs25h7ajKpeoy0sf9SnCYTpS0L07Yy3sPw4CCqmOJw+CwJMTT/UdR5xqrE9bCddgR+NG9xfRQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bs58-77/MAL-2026-14018.json"