MAL-2026-13964

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (99502d2feb4743e651628a07ca032fa0cc813ff6482cae15d9c2f1fb6fce63c4) Package name 'bs58-15' impersonates the widely-used 'bs58' base58 encoding library, and its package.json metadata (repository, homepage, bugs) points at the legitimate cryptocoinjs/bs58 project despite being published by an unrelated author, presenting false provenance. The package's single runtime dependency is 'base65-15x', a lookalike of the legitimate 'base-x' package. The main entry executes `require("base65-15x")` and immediately invokes the returned value as a function against an alphabet constant on module load, so any consumer that installs bs58-15 and requires it pulls attacker-named dependency code into their dependency graph and executes it at import time.