base65-12x

Details

**Severity:** Critical

**Affected versions:** `= 5.0.2`

## Source: amazon-inspector (79b553d84d7f4dc5347840ddb97f16738eed2e52ac9757b48d2cb31ba1af7122)
The package name base65-12x typosquats the popular base-x base-encoding library and reuses base-x's repository as its homepage. Both the CJS entry (index.js around line 116) and the ESM entry (src/esm/index.js around line 114) append an approximately 123 KB top-level obfuscated block after a copy of the legitimate base-x source. The block installs a VM-style dispatcher on globalThis (registries named vmr_3f4688 and vmw_bf472f), manipulates Object.defineProperty and __proto__, and contains multiple fetch references, so a network-capable code path is wired up and runs unconditionally when a consumer requires or imports the package. A base-encoding library has no functional need for a large globalThis-poisoning obfuscated VM with network fetch at module top level; the payload is duplicated across both module systems so it fires for CJS and ESM consumers alike.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/015eee03d13dd119c608c3fda8034ae6e540e772/osv/malicious/npm/base65-12x/MAL-2026-13746.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/015eee03d13dd119c608c3fda8034ae6e540e772/osv/malicious/npm/base65-12x/MAL-2026-13746.json
- https://www.npmjs.com/package/base65-12x/v/5.0.2
- https://github.com/advisories/GHSA-q6r6-qrfx-v3wp

Compromised versions (1)

• = 5.0.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.