The base65-11x npm package masquerades as a base-x encoding utility but includes a ~123KB obfuscated malicious payload embedded at the module top level in both its CommonJS and ESM entrypoints. This payload is wrapped in a custom VM interpreter and executes automatically when the package is imported or required, which is unusual for a simple base-encoding utility. The obfuscation and execution method prevent recovery of the payload behavior without runtime execution. The package is considered fully compromising to any system on which it is installed or run, with potential for complete attacker control and exposure of stored secrets.

Systems with the base65-11x package installed or running are considered fully compromised. Attackers may gain complete control over the affected computer, potentially accessing all stored secrets and keys. Immediate rotation of all credentials from a separate, trusted system is advised. Simply removing the package may not fully remediate the compromise due to possible persistence of malicious components.

Remove the base65-11x package immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on the compromised systems, performing this rotation from a different, trusted machine. Because the package executes a concealed payload at load time, assume full system compromise and conduct a thorough investigation and remediation. No official patch or fix is available; the package itself is malicious and should be avoided entirely.