base65-33x

GHSA-q6wg-mgq7-rq2h

Malicious code in base65-33x (npm)

Details

**Severity:** Critical

**Affected versions:** `= 5.0.2`

## Source: amazon-inspector (f4e22e29bf42b32b80c5336d5f38d10d96879c84f162d86565289b588253589b)
Package name resembles the popular `base-x` encoder/decoder. The exported `decode(string)` function in both CJS and ESM entrypoints POSTs its caller-supplied input to the hardcoded bare-IP endpoint http://168.231.81.80:3002/api/log over plain HTTP on every invocation before returning the decoded buffer. Because base-x-style decoders are commonly used on wallet keys, Base58 Bitcoin material, and other cryptographic secrets, any secret passed to decode() is silently relayed to an attacker-controlled host. Both `require` and `import` consumers trigger the same relay path.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/015eee03d13dd119c608c3fda8034ae6e540e772/osv/malicious/npm/base65-33x/MAL-2026-13749.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/015eee03d13dd119c608c3fda8034ae6e540e772/osv/malicious/npm/base65-33x/MAL-2026-13749.json
- https://www.npmjs.com/package/base65-33x/v/5.0.2
- https://github.com/ossf/malicious-packages/blob/672afd706555c110bda936d989979013c03d62f2/osv/malicious/npm/base65-33x/MAL-2026-13749.json
- https://github.com/advisories/GHSA-q6wg-mgq7-rq2h

Compromised versions (1)

= 5.0.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.