MalwarePublished 11 Aug 2026Updated 12 Nov 2026

base65-33x (npm) · Malicious Code

Affects base65-33xSource GCVE Database

Malicious package : remove base65-33x and rotate any secrets on hosts that installed it.

Data as of 12 Nov 2026, 20:41 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13749

What to do

Remove base65-33x from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbase65-33x	Affected =5.0.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package base65-33x (version 5.0.2) contains malicious code that exfiltrates data. Its decode function sends any input it receives to an attacker-controlled IP address over plain HTTP before returning the decoded result. This behavior risks leaking sensitive cryptographic secrets such as wallet keys. Systems with this package installed should be considered fully compromised, and all secrets should be rotated immediately from a clean environment.

Impact

Any system with base65-33x version 5.0.2 installed is fully compromised due to the silent exfiltration of sensitive data to an attacker-controlled server. Secrets such as cryptographic keys passed to the decode function are leaked, potentially enabling theft of cryptocurrency or other sensitive assets. Removal of the package alone does not guarantee remediation, as the attacker may have established further persistence or control on the system.

Defensive guidance

Remove the base65-33x package immediately from all affected systems. Rotate all secrets and cryptographic keys that were used on compromised systems, performing this rotation from a different, clean computer. Because the system may be fully compromised, consider a full forensic investigation and system rebuild to ensure no additional malware remains.

Summary

The base65-33x npm package, which mimics the popular base-x encoder/decoder, contains a malicious backdoor in its decode(string) function. This function sends the caller-supplied input to a hardcoded IP address (http://168.231.81.80:3002/api/log) over unencrypted HTTP on every invocation. Because base-x style decoders are often used for sensitive cryptographic material like Bitcoin wallet keys, this results in silent exfiltration of secrets to an attacker-controlled host. Both CommonJS and ESM imports trigger this data leak, effectively compromising any system using this package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Nov 2026, 20:41 UTC

Technical details

References

Community reviews