bs58-15 is a malicious npm typosquat of the legitimate bs58 package. Its main module requires and re-exports the base65-15x package, which is a near-verbatim clone of the legitimate base-x package but with a malicious decode() function. This decode() function exfiltrates every string passed to it by POSTing the raw input to a hardcoded IP address (http://46.250.253.63:3000/api/log) before throwing an error. Because base-x/bs58 are used in crypto tooling to decode private keys and seeds, this results in frequent exfiltration of sensitive secrets. The bs58-15 package and its siblings (bs58-33, bs58-77) were published within a short timeframe by the same npm maintainer account, forming a matched delivery and exfiltration campaign. Any project installing bs58-15 will execute the malicious code at import time due to the immediate invocation of the malicious dependency.

The malicious base65-15x dependency exfiltrates sensitive data such as private keys and seeds used in cryptographic operations by sending them to an attacker-controlled server. This compromises the confidentiality of secrets in any project that installs and uses bs58-15, potentially leading to unauthorized access or theft of cryptographic assets. The attack is triggered at runtime when the package is imported, making it a direct risk to dependent projects.

No official patch or fix is currently available. Users and developers should avoid installing or using the bs58-15 package and its siblings (bs58-33, bs58-77). Audit dependencies carefully to ensure no typosquatting or malicious packages are included. Remove bs58-15 and any related malicious packages from projects and dependency trees immediately. Monitor for updates from npm or the legitimate bs58 package maintainers for any official advisories or remediation.