MAL-2026-13747
Malicious code in base65-13x (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (59226f2c38efcc1dd5de6423edfc866125564cd726915307d7a05ca5b5f13529) base65-13x@5.0.2 impersonates cryptocoinjs/base-x, reusing its README, homepage, and API surface, but the exported decode(string) function in both src/esm/index.js (line 114) and src/cjs/index.cjs (line 116) contains a ~123KB VM-style obfuscated payload using rotated identifiers (vmR, vmr_92f1a9, vmw_4ee781) built via Object.defineProperty. The blob contains multiple references to the Function constructor and fetch, indicating dynamic code construction and outbound network I/O. Genuine base-x is roughly 50 lines of pure arithmetic with no obfuscation and no network activity. Any consumer invoking decode() on this package executes the packed VM, which dynamically constructs code with fetch capability. The destination hosts and constructed code are concealed by the obfuscation and are not statically visible.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for base65-13x (npm). Pin to a known-safe version or switch to an alternative.