MAL-2026-13747
Malicious code in base65-13x (npm)
상세
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (59226f2c38efcc1dd5de6423edfc866125564cd726915307d7a05ca5b5f13529) base65-13x@5.0.2 impersonates cryptocoinjs/base-x, reusing its README, homepage, and API surface, but the exported decode(string) function in both src/esm/index.js (line 114) and src/cjs/index.cjs (line 116) contains a ~123KB VM-style obfuscated payload using rotated identifiers (vmR, vmr_92f1a9, vmw_4ee781) built via Object.defineProperty. The blob contains multiple references to the Function constructor and fetch, indicating dynamic code construction and outbound network I/O. Genuine base-x is roughly 50 lines of pure arithmetic with no obfuscation and no network activity. Any consumer invoking decode() on this package executes the packed VM, which dynamically constructs code with fetch capability. The destination hosts and constructed code are concealed by the obfuscation and are not statically visible.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
No fixed version published yet for base65-13x (npm). Pin to a known-safe version or switch to an alternative.