base65-13x

GHSA-pm9q-qccp-rj4g

Malicious code in base65-13x (npm)

Details

**Severity:** Critical

**Affected versions:** `= 5.0.2`

## Source: amazon-inspector (59226f2c38efcc1dd5de6423edfc866125564cd726915307d7a05ca5b5f13529)
[email protected] impersonates cryptocoinjs/base-x, reusing its README, homepage, and API surface, but the exported decode(string) function in both src/esm/index.js (line 114) and src/cjs/index.cjs (line 116) contains a ~123KB VM-style obfuscated payload using rotated identifiers (vmR, vmr_92f1a9, vmw_4ee781) built via Object.defineProperty. The blob contains multiple references to the Function constructor and fetch, indicating dynamic code construction and outbound network I/O. Genuine base-x is roughly 50 lines of pure arithmetic with no obfuscation and no network activity. Any consumer invoking decode() on this package executes the packed VM, which dynamically constructs code with fetch capability. The destination hosts and constructed code are concealed by the obfuscation and are not statically visible.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/015eee03d13dd119c608c3fda8034ae6e540e772/osv/malicious/npm/base65-13x/MAL-2026-13747.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/015eee03d13dd119c608c3fda8034ae6e540e772/osv/malicious/npm/base65-13x/MAL-2026-13747.json
- https://www.npmjs.com/package/base65-13x/v/5.0.2
- https://github.com/advisories/GHSA-pm9q-qccp-rj4g

Compromised versions (1)

= 5.0.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.