VYPR
← All malware advisories

npm · Malicious package advisory

Malware

base65-33x

MAL-2026-13749

Malicious code in base65-33x (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (f4e22e29bf42b32b80c5336d5f38d10d96879c84f162d86565289b588253589b)
Package name resembles the popular `base-x` encoder/decoder. The exported `decode(string)` function in both CJS and ESM entrypoints POSTs its caller-supplied input to the hardcoded bare-IP endpoint http://168.231.81.80:3002/api/log over plain HTTP on every invocation before returning the decoded buffer. Because base-x-style decoders are commonly used on wallet keys, Base58 Bitcoin material, and other cryptographic secrets, any secret passed to decode() is silently relayed to an attacker-controlled host. Both `require` and `import` consumers trigger the same relay path.

Compromised versions (1)

  • 5.0.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.