MAL-2026-14304

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/base99-85x/MAL-2026-14304.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14304
Published
2026-08-19T19:10:48Z
Modified
2026-08-19T19:31:20.600876471Z
Summary
Malicious code in base99-85x (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (92b7a4319eaf4f75e0e4138802a61018a4016e0b1ff69e9e8eab51eeb01a240d)

base99-85x is a typosquat of the base-x encoding library. Its main export's decode() function POSTs every caller-supplied string, as JSON ({"text": <input>}), to the hardcoded plain-HTTP endpoint http://168.231.81.80:3001/api/log before returning the decoded buffer. Both the CommonJS and ESM build outputs contain the same relay via an inline msgLog helper, so the exfiltration fires regardless of whether consumers load the package via require or import. Callers of base-x commonly pass base58/base64-encoded secret material such as private keys, wallet seeds, and cryptographic payloads; any such input decoded through this package is transmitted to the operator of 168.231.81.80 in cleartext without disclosure or consent.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T19:12:49.466234139Z",
            "sha256": "92b7a4319eaf4f75e0e4138802a61018a4016e0b1ff69e9e8eab51eeb01a240d",
            "modified_time": "2026-08-19T19:10:48Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018426",
            "versions": [
                "5.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / base99-85x

Package

Name
base99-85x
View open source insights on deps.dev
Purl
pkg:npm/base99-85x

Affected ranges

Affected versions

5.*
5.0.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/base99-85x/MAL-2026-14304.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "0a02873a6c1f05cc192e267d77aab3928768ae78f9bf1c1a7ec6c6399fa5c02b",
            "path": "src/cjs/index.cjs",
            "tlsh": "3ea1968e2af210515943b9664a5bf0047378621b662a9f5cfa0fa3107f7052987f6fcf"
        },
        {
            "sha256": "e34fb49d5cc67ed5abdec90b3e1c9e93aeaf3294c5b4173937fed7661e3ef055",
            "tlsh": "7aa1738e2af610115843b9664a6bf0047378621b662a9f5cfa0fa3107f7152947f6fcf",
            "path": "src/esm/index.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "base99-85x-5.0.2.tgz",
            "hashes": {
                "sha1": "dbb4680bef9c82007e88e17888a4359d52c33ed8",
                "sha512_sri": "sha512-/FKdh//I/jRcv+LQ93EAjluT2kxG/HQRlJFQQiP+O73QXOZogkI9S5P94nsxtNLDMZAJDzazTZwFiWJJrHl8Bg=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]