The bs58-11 npm package impersonates the popular bs58 module by name and README instructions but is a malicious package. Its tarball contains only a two-line wrapper that requires and invokes a dependency named base65-11x, which resembles the legitimate base-x package but is not included in the tarball. The wrapper itself does not contain direct malicious code such as exfiltration or backdoors, but the behavior depends on the base65-11x dependency, which may be malicious. According to the GHSA malware advisory, any computer with this package installed should be considered fully compromised, requiring immediate secret and key rotation and package removal. However, full remediation is uncertain due to potential persistent malicious software.

Systems with bs58-11 installed are considered fully compromised. Attackers may have gained full control, potentially accessing all stored secrets and keys. The malicious dependency base65-11x may execute harmful code beyond the wrapper. Simply removing the package does not guarantee removal of all malicious components or backdoors, posing a high risk to system integrity and confidentiality.

Immediate removal of the bs58-11 package is recommended. All secrets and keys stored on the compromised system should be rotated from a separate, trusted computer. Due to the likelihood of full system compromise, consider rebuilding or thoroughly cleaning the affected system. Monitor for any signs of persistent malicious activity. Patch status is not applicable as this is a malicious package rather than a software vulnerability with a fix.