The bs58-12 npm package impersonates the popular bs58 library by copying its README and advertising installation similarly, but its code merely requires the base65-12x package. The package bs58-12 itself does not perform direct malicious actions during install or runtime, but the dependency base65-12x is suspicious and unexamined. Security advisories classify bs58-12 as malicious, advising that systems with it installed are fully compromised and require secret/key rotation and package removal. No CVSS score or detailed technical exploit data is available.

Systems with bs58-12 installed are considered fully compromised, implying that attackers may have gained full control. All secrets and keys stored on such systems should be rotated immediately from a separate, trusted environment. Removing the package is necessary but may not fully remove all malicious components or backdoors introduced by the dependency base65-12x or other payloads.

Remove the bs58-12 package immediately. Rotate all secrets, credentials, and keys from a different, uncompromised system. Because full compromise is likely, consider rebuilding affected systems from known good backups or reinstalling the operating system. Monitor for any suspicious activity that may indicate persistent threats. Patch status is not confirmed; no official fix or update is indicated. Check vendor advisories or npm security notices for updates on remediation.