Malicious code in bs58-33 (npm)
The npm package bs58-33 is a typosquatting package that re-exports a malicious dependency base65-33x. The base65-33x package exfiltrates any string passed to its decode() function by sending it via HTTP POST to a hardcoded command-and-control server. Since base-x/bs58 libraries are commonly used to decode cryptocurrency private keys and seeds, this exfiltration can leak sensitive secrets. The bs58-33 package was published alongside related malicious packages by the same maintainer in a coordinated campaign. Installing bs58-33 introduces this key-exfiltration behavior into dependent projects.
AI Analysis
Technical Summary
The npm package bs58-33 is a typosquatting clone of the legitimate bs58 base58 codec. It does not contain malicious code itself but depends on base65-33x, a malicious package that clones base-x and exfiltrates all input strings passed to its decode() method by sending them to a hardcoded IP address (http://168.231.81.80:3002/api/log). Because base-x/bs58 libraries are used in cryptocurrency tooling to decode private keys and seeds, the exfiltrated data often includes sensitive secrets. This package was published as part of a six-package campaign by a single maintainer account within a short time window. Installing bs58-33 is sufficient to introduce this exfiltration behavior into a project.
Potential Impact
The impact is the silent exfiltration of sensitive data, including cryptocurrency private keys and seeds, from any project that uses the bs58-33 package. This can lead to compromise of cryptocurrency assets or other secrets decoded using the affected library. The malicious behavior is triggered at runtime when decode() is called, sending data to an attacker-controlled server.
Mitigation Recommendations
No official patch or fix is currently documented. Users should avoid installing or using the bs58-33 package and its sibling packages (bs58-15, bs58-77) published by the same maintainer. Replace bs58-33 with the legitimate bs58 package from the official source. Audit dependencies to ensure no transitive inclusion of these malicious packages. Monitor for and remove any instances of base65-33x or related packages in projects.
Malicious code in bs58-33 (npm)
Description
The npm package bs58-33 is a typosquatting package that re-exports a malicious dependency base65-33x. The base65-33x package exfiltrates any string passed to its decode() function by sending it via HTTP POST to a hardcoded command-and-control server. Since base-x/bs58 libraries are commonly used to decode cryptocurrency private keys and seeds, this exfiltration can leak sensitive secrets. The bs58-33 package was published alongside related malicious packages by the same maintainer in a coordinated campaign. Installing bs58-33 introduces this key-exfiltration behavior into dependent projects.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The npm package bs58-33 is a typosquatting clone of the legitimate bs58 base58 codec. It does not contain malicious code itself but depends on base65-33x, a malicious package that clones base-x and exfiltrates all input strings passed to its decode() method by sending them to a hardcoded IP address (http://168.231.81.80:3002/api/log). Because base-x/bs58 libraries are used in cryptocurrency tooling to decode private keys and seeds, the exfiltrated data often includes sensitive secrets. This package was published as part of a six-package campaign by a single maintainer account within a short time window. Installing bs58-33 is sufficient to introduce this exfiltration behavior into a project.
Potential Impact
The impact is the silent exfiltration of sensitive data, including cryptocurrency private keys and seeds, from any project that uses the bs58-33 package. This can lead to compromise of cryptocurrency assets or other secrets decoded using the affected library. The malicious behavior is triggered at runtime when decode() is called, sending data to an attacker-controlled server.
Mitigation Recommendations
No official patch or fix is currently documented. Users should avoid installing or using the bs58-33 package and its sibling packages (bs58-15, bs58-77) published by the same maintainer. Replace bs58-33 with the legitimate bs58 package from the official source. Audit dependencies to ensure no transitive inclusion of these malicious packages. Monitor for and remove any instances of base65-33x or related packages in projects.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14017
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a7f43f1bf8831d5395d7677
Added to database: 08/14/2026, 16:36:01 UTC
Last enriched: 08/14/2026, 16:48:17 UTC
Last updated: 09/25/2026, 03:17:24 UTC
Views: 19
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.