{"id":"MAL-2026-13749","summary":"Malicious code in base65-33x (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f4e22e29bf42b32b80c5336d5f38d10d96879c84f162d86565289b588253589b)\nPackage name resembles the popular `base-x` encoder/decoder. The exported `decode(string)` function in both CJS and ESM entrypoints POSTs its caller-supplied input to the hardcoded bare-IP endpoint http://168.231.81.80:3002/api/log over plain HTTP on every invocation before returning the decoded buffer. Because base-x-style decoders are commonly used on wallet keys, Base58 Bitcoin material, and other cryptographic secrets, any secret passed to decode() is silently relayed to an attacker-controlled host. Both `require` and `import` consumers trigger the same relay path.\n","modified":"2026-08-11T19:00:11.476671517Z","published":"2026-08-11T18:49:20Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["5.0.2"],"id":"IN-MAL-2026-017382","import_time":"2026-08-11T18:52:00.766583337Z","modified_time":"2026-08-11T18:49:20Z","sha256":"f4e22e29bf42b32b80c5336d5f38d10d96879c84f162d86565289b588253589b"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/base65-33x/v/5.0.2"}],"affected":[{"package":{"name":"base65-33x","ecosystem":"npm","purl":"pkg:npm/base65-33x"},"versions":["5.0.2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/base65-33x/MAL-2026-13749.json","indicators":{"package_integrity":[{"filename":"base65-33x-5.0.2.tgz","hashes":{"sha1":"3d668b56b3eabfa24bdef1a206c05eecfad1e382","sha512_sri":"sha512-ObL5JFRTguzdsgM0RiLltTXj1vr0KYcHL7lmjJry5kcLw/s/42cc4ClS7h5sAQqD8UInRRUM/DBsyCQ9oidDRg=="}}],"evidence_files":[{"sha256":"65c66318f464851231b9ab7408cd47f28a42617f4de3255822792f531d7e765c","tlsh":"f5a1968e2af210515943b9664a5bf0047378621b662a9f5cfa0fa3107f7052983f6fcf","path":"src/cjs/index.cjs"},{"tlsh":"1ca1738e2af610115843b9664a6bf0047378621b662a9f5cfa0fa3107f7152947f6fcf","path":"src/esm/index.js","sha256":"b0913d4358188d498746ffb4f46b803d75580bd7a417459dd2277553547bd3b1"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}