MAL-2026-13750
Malicious code in base65-77x (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (ef76e83f2641fcfacf488a6ef61447fac81f6a24cff6287b407a385374b9ddf7) The package impersonates base-x (name, description, keywords, and homepage copied from base-x) and patches the advertised decode() function in both the CommonJS and ESM entrypoints to POST the caller-supplied input string to a hardcoded remote destination at http://46.250.253.63:3000/api/log over plain HTTP before returning the decoded result. Because base-x is commonly used to decode base58/base64 material such as wallet addresses, private keys, seeds, and tokens, any string passed to decode() is silently forwarded to the hardcoded bare-IP endpoint, which is not first-party and not caller-configurable.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for base65-77x (npm). Pin to a known-safe version or switch to an alternative.