bs58-77 (npm) · Malicious Code
Affects bs58-77Source GCVE Database
Malicious package : remove bs58-77 and rotate any secrets on hosts that installed it.
Data as of 14 Aug 2026, 16:48 UTC
Malicious package
Published to npm · OSV MAL-2026-14018
What to do
Remove bs58-77 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmbs58-77 | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package bs58-77 is a typosquatting package that does not contain malicious code itself but depends on a malicious package base65-77x. The base65-77x package exfiltrates sensitive data by sending decoded strings, often private keys or seeds, to a hardcoded command and control server. This behavior enables secret leakage when bs58-77 is installed in a project. The malicious packages were published in a coordinated campaign by a single maintainer account within a short time frame. The affected version is exactly 6.0.1.