{"id":"MAL-2026-10606","summary":"Malicious code in base58-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ba5517883cb10a7c76e95fdf21a4ffce21c13fe1ca42fafc13f5adb021599772)\nThe package's index.js contains multiple Buffer.from(...) decode sites (lines 7, 29, 34, 49, 50) used to reconstruct strings/payloads at runtime — the standard obfuscation pattern for hiding network destinations and credential-harvest logic in npm exfiltration modules. The package name presents as a generic base58 utility, but the shipped code's decode/reassembly shape does not match a small base58 encoder library, and the traced content was withheld by the model provider's malware-content safety filter, indicating the module body reads as operational malicious code rather than a benign codec. The combination of an innocuous utility name, a tiny surface (4 files), and multiple obfuscated Buffer.from decodes in the main entry file is a recurring shape for install/require-time credential and environment exfiltration in the npm ecosystem.\n","modified":"2026-07-14T18:49:32.584635417Z","published":"2026-07-14T17:47:22Z","database_specific":{"malicious-packages-origins":[{"versions":["1.0.3"],"id":"IN-MAL-2026-010529","import_time":"2026-07-14T18:28:26.229397818Z","modified_time":"2026-07-14T17:47:48Z","sha256":"34f54e86ffeb2667a7cef8dd34d8693c007d696a19041a5967f9281eaf99d346","source":"amazon-inspector"},{"modified_time":"2026-07-14T17:47:22Z","sha256":"ec6be77583a4d5fdb28420c0c596ace10d664766fe81976a66b99dff674703f4","source":"amazon-inspector","versions":["1.0.5"],"id":"IN-MAL-2026-010526","import_time":"2026-07-14T18:28:25.840961581Z"},{"sha256":"fadb3ffd853509cd69312b57da13b6e2bcd85615f65b0526116c456a70de47d4","source":"amazon-inspector","versions":["1.0.4"],"id":"IN-MAL-2026-010530","import_time":"2026-07-14T18:28:26.335422331Z","modified_time":"2026-07-14T17:47:55Z"},{"modified_time":"2026-07-14T17:47:30Z","sha256":"3562adad8a56b743ca4e66c56ef40e012fe89078d25e2d773167c4f5a157b006","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-010527","import_time":"2026-07-14T18:28:25.946424062Z"},{"id":"IN-MAL-2026-010528","import_time":"2026-07-14T18:28:26.086050019Z","modified_time":"2026-07-14T17:47:41Z","sha256":"ba5517883cb10a7c76e95fdf21a4ffce21c13fe1ca42fafc13f5adb021599772","source":"amazon-inspector","versions":["1.0.1"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/base58-utils/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/base58-utils/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/base58-utils/v/1.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/base58-utils/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/base58-utils/v/1.0.1"}],"affected":[{"package":{"name":"base58-utils","ecosystem":"npm","purl":"pkg:npm/base58-utils"},"versions":["1.0.3","1.0.5","1.0.4","1.0.0","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"sha256":"fd523dcafc7e9ddb24cbd0e89f07ab97aa3c25043eb3f8d17f120b28aafbbb33","tlsh":"d361b5991bf67350821f7058896bc8057afde1013908c99cfe8d61820f20d788bfbaed","path":"index.js"}],"package_integrity":[{"filename":"base58-utils-1.0.3.tgz","hashes":{"sha1":"45c068166337aa788d5ebedca11a59437de43f23","sha512_sri":"sha512-EK3ApIci1D92iJ2inG+QycC833+NcXf7coOr8eDWP24xozSBUjox2UVwvzyXb2Lobd1dqPEOjGGOo8QmulIbBQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/base58-utils/MAL-2026-10606.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}