Malicious code in bs58-86 (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (057e2e470e0bc9dbfd2ff37955c0c7d051cca944025b9d62c882ffc98c4434e5) Package `[email protected]` reproduces the name, README, repository URL (`cryptocoinjs/bs58`), and exported API of the widely-used `bs58` base58 encoding library (>10M downloads/week). The only functional code in `src/cjs/index.cjs` is `require('base62-86x')(ALPHABET)` — instead of depending on the real `base-x` package that genuine `bs58` uses, this package pulls in `base62-86x` (declared as `^5.0.4` in package.json dependencies), an unrelated package controlled by a different publisher. All actual base-x implementation runs out of `base62-86x`, so any developer who installs `bs58-86` thinking it is `bs58` ends up executing whatever `base62-86x` ships, at require time. This is the typosquat-plus-dependency-redirect shape: the lure package is a thin shim whose only effect on the installer is to pull in and execute the redirected dependency. ## Source: ghsa-malware (a08f802970ec2018540c73586abf53983f4038c066307734554eeb2686d71607) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The bs58-86 package (version 6.0.1) is a typosquatting malicious package that mimics the legitimate bs58 base58 encoding library by reproducing its name, README, repository URL, and API. Instead of using the genuine base-x dependency, it depends on base62-86x, an unrelated package controlled by a different publisher. This causes any developer who installs bs58-86 to execute arbitrary code from base62-86x at require time, effectively compromising the host system. This is a typosquat-plus-dependency-redirect attack, where the lure package is a thin shim that pulls in and runs malicious code from the redirected dependency.
Potential Impact
Any computer with [email protected] installed or running should be considered fully compromised. Attackers may have gained full control, risking exposure of all secrets and keys stored on the system. Immediate rotation of all credentials from a different, trusted machine is required. Simply removing the package may not eliminate all malicious software or backdoors introduced by the attacker.
Mitigation Recommendations
No official patch or fix is available for this malicious package. The recommended mitigation is to remove [email protected] immediately and consider the affected system fully compromised. Rotate all secrets and keys from a secure environment. Due to the potential for persistent compromise, further forensic analysis and system restoration from clean backups are advised.
Malicious code in bs58-86 (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (057e2e470e0bc9dbfd2ff37955c0c7d051cca944025b9d62c882ffc98c4434e5) Package `[email protected]` reproduces the name, README, repository URL (`cryptocoinjs/bs58`), and exported API of the widely-used `bs58` base58 encoding library (>10M downloads/week). The only functional code in `src/cjs/index.cjs` is `require('base62-86x')(ALPHABET)` — instead of depending on the real `base-x` package that genuine `bs58` uses, this package pulls in `base62-86x` (declared as `^5.0.4` in package.json dependencies), an unrelated package controlled by a different publisher. All actual base-x implementation runs out of `base62-86x`, so any developer who installs `bs58-86` thinking it is `bs58` ends up executing whatever `base62-86x` ships, at require time. This is the typosquat-plus-dependency-redirect shape: the lure package is a thin shim whose only effect on the installer is to pull in and execute the redirected dependency. ## Source: ghsa-malware (a08f802970ec2018540c73586abf53983f4038c066307734554eeb2686d71607) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The bs58-86 package (version 6.0.1) is a typosquatting malicious package that mimics the legitimate bs58 base58 encoding library by reproducing its name, README, repository URL, and API. Instead of using the genuine base-x dependency, it depends on base62-86x, an unrelated package controlled by a different publisher. This causes any developer who installs bs58-86 to execute arbitrary code from base62-86x at require time, effectively compromising the host system. This is a typosquat-plus-dependency-redirect attack, where the lure package is a thin shim that pulls in and runs malicious code from the redirected dependency.
Potential Impact
Any computer with [email protected] installed or running should be considered fully compromised. Attackers may have gained full control, risking exposure of all secrets and keys stored on the system. Immediate rotation of all credentials from a different, trusted machine is required. Simply removing the package may not eliminate all malicious software or backdoors introduced by the attacker.
Mitigation Recommendations
No official patch or fix is available for this malicious package. The recommended mitigation is to remove [email protected] immediately and consider the affected system fully compromised. Rotate all secrets and keys from a secure environment. Due to the potential for persistent compromise, further forensic analysis and system restoration from clean backups are advised.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6448
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-9gvv-wfph-q6rj"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a520ed368715ace43901b3f
Added to database: 07/11/2026, 09:37:23 UTC
Last enriched: 07/11/2026, 10:01:04 UTC
Last updated: 07/27/2026, 19:14:45 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.