MalwarePublished 11 Aug 2026

bs58-12 (npm) · Malicious Code

Affects bs58-12Source GCVE Database

Malicious package : remove bs58-12 and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 17:00 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13759

What to do

Remove bs58-12 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbs58-12	Affected =6.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package bs58-12 masquerades as the legitimate bs58 base58 library but is a thin wrapper that depends on another suspicious package, base65-12x. While bs58-12 itself does not contain direct malicious code such as exfiltration or destructive scripts, the risk depends on the behavior of base65-12x, which has not been analyzed here. Security sources warn that any system with bs58-12 installed should be considered fully compromised, recommending immediate secret and key rotation and removal of the package. Complete remediation cannot be guaranteed by removal alone due to potential persistent compromise.

Impact

Systems with bs58-12 installed are considered fully compromised, implying that attackers may have gained full control. All secrets and keys stored on such systems should be rotated immediately from a separate, trusted environment. Removing the package is necessary but may not fully remove all malicious components or backdoors introduced by the dependency base65-12x or other payloads.

Defensive guidance

Remove the bs58-12 package immediately. Rotate all secrets, credentials, and keys from a different, uncompromised system. Because full compromise is likely, consider rebuilding affected systems from known good backups or reinstalling the operating system. Monitor for any suspicious activity that may indicate persistent threats. Check vendor advisories or npm security notices for updates on remediation.

Summary

The bs58-12 npm package impersonates the popular bs58 library by copying its README and advertising installation similarly, but its code merely requires the base65-12x package. The package bs58-12 itself does not perform direct malicious actions during install or runtime, but the dependency base65-12x is suspicious and unexamined. Security advisories classify bs58-12 as malicious, advising that systems with it installed are fully compromised and require secret/key rotation and package removal. No CVSS score or detailed technical exploit data is available.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 17:00 UTC

Technical details

References

Community reviews