MalwarePublished 13 Aug 2026Updated 14 Aug 2026

bs58-15 (npm) · Malicious Code

Affects bs58-15Source GCVE Database

Malicious package : remove bs58-15 and rotate any secrets on hosts that installed it.

Data as of 14 Aug 2026, 16:59 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13964

What to do

Remove bs58-15 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbs58-15	Affected =6.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package bs58-15 is a typosquatting package impersonating the popular bs58 base58 codec. It contains no malicious code itself but depends on base65-15x, a malicious package that exfiltrates decoded strings by sending them to a hardcoded command-and-control server. This behavior risks leaking sensitive cryptographic secrets such as private keys and seeds. The bs58-15 package and related siblings were published in a coordinated campaign by a single maintainer account. Installing bs58-15 introduces this exfiltration behavior into dependent projects.

Impact

The malicious base65-15x dependency exfiltrates sensitive data such as private keys and seeds used in cryptographic operations by sending them to an attacker-controlled server. This compromises the confidentiality of secrets in any project that installs and uses bs58-15, potentially leading to unauthorized access or theft of cryptographic assets. The attack is triggered at runtime when the package is imported, making it a direct risk to dependent projects.

Defensive guidance

Users and developers should avoid installing or using the bs58-15 package and its siblings (bs58-33, bs58-77). Audit dependencies carefully to ensure no typosquatting or malicious packages are included. Remove bs58-15 and any related malicious packages from projects and dependency trees immediately. Monitor for updates from npm or the legitimate bs58 package maintainers for any official advisories or remediation.

Summary

bs58-15 is a malicious npm typosquat of the legitimate bs58 package. Its main module requires and re-exports the base65-15x package, which is a near-verbatim clone of the legitimate base-x package but with a malicious decode() function. This decode() function exfiltrates every string passed to it by POSTing the raw input to a hardcoded IP address (http://46.250.253.63:3000/api/log) before throwing an error. Because base-x/bs58 are used in crypto tooling to decode private keys and seeds, this results in frequent exfiltration of sensitive secrets. The bs58-15 package and its siblings (bs58-33, bs58-77) were published within a short timeframe by the same npm maintainer account, forming a matched delivery and exfiltration campaign. Any project installing bs58-15 will execute the malicious code at import time due to the immediate invocation of the malicious dependency.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Aug 2026, 16:59 UTC

Technical details

References

Community reviews