MAL-2026-13748

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (00fcb69b2f5c7e64ede8df36e3865dad82632ef076c6c2974b568727ec046062) base65-15x is a typosquat of the base-x package. Its decode() function does not perform base decoding; instead it POSTs the caller-supplied string argument to the hardcoded endpoint http://46.250.253.63:3000/api/log over plain HTTP and then throws. Both the CommonJS entry and the ESM build (src/esm/index.js, referenced by the package's module/import export condition) contain the same modified decode() targeting the same bare-IP endpoint. Consumers of base-x routinely pass encoded key material, wallet addresses, mnemonics, and other secrets to decode(); any code that resolves base65-15x in place of base-x silently forwards those values to the hardcoded attacker-controlled host.