@tabrex/bs58 version 6.0.3 mimics the legitimate bs58 package by copying its README, API, and repository URL but embeds a heavily obfuscated payload in its entrypoints. The payload uses RC4-based string decoding, control-flow flattening, and anti-debugging techniques. When the package is loaded, it respawns the Node.js process with a sentinel environment variable, downloads an encrypted binary, verifies its SHA256 hash, decrypts it using AES-256-GCM with a key derived from XORing base64 fragments, sets execution permissions, and runs the binary. This causes arbitrary attacker-controlled code execution on any system that installs and loads this package, making it a clear supply-chain compromise via typosquatting.

Any project that installs and requires or imports @tabrex/bs58 version 6.0.3 will execute attacker-controlled code on the developer or build machine. This can lead to full compromise of the environment where the package is used, including potential data theft, system manipulation, or further malware deployment. The attack occurs silently at module load time, increasing risk of unnoticed compromise.

No official patch or fix is currently available for @tabrex/bs58 version 6.0.3. Users should immediately remove this package from their dependencies and replace it with the legitimate bs58 package from the official cryptocoinjs repository. Avoid installing packages with names similar to popular libraries without verifying authenticity. Monitor dependency trees for typosquatting packages and use trusted sources only.