The base62-86x npm package, versions 5.0.4 and 5.0.5, is a malicious impersonation of the legitimate base-x/base62 library. Its decode(string) function in both CommonJS and ESM builds has been modified to silently send every input string to hardcoded Telegram Bot API endpoints controlled by attackers. The exfiltration is heavily obfuscated, including string-array rotation and a custom bytecode VM, to conceal the network calls. This results in the leakage of sensitive data such as cryptocurrency addresses and private keys passed to decode(). Two distinct Telegram bot tokens suggest a staged or failover exfiltration infrastructure. There is no documented or opt-in behavior for this network communication, confirming malicious intent. Systems with this package installed should be considered fully compromised.

Any secrets, keys, or sensitive base-encoded data passed to the decode() function of base62-86x versions 5.0.4 and 5.0.5 are exfiltrated to attacker-controlled Telegram bots. This compromises confidentiality of sensitive information and potentially leads to full system compromise. The presence of this package on a system indicates a high likelihood that attackers have gained unauthorized access to sensitive data and possibly control over the system.

No official patch or fix is currently available. Users should immediately remove the base62-86x package versions 5.0.4 and 5.0.5 from their environments. Because the package exfiltrates sensitive data and may have allowed attackers full control, all secrets and keys stored on affected systems should be rotated immediately from a separate, trusted environment. Systems with this package installed should be treated as fully compromised and undergo thorough incident response procedures. Monitor for any unauthorized network activity related to Telegram Bot API endpoints mentioned in the malicious code. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.