The @tabrex/bs58 npm package version 6.0.3 is a malicious typosquatting package impersonating the legitimate cryptocoinjs/bs58 package. It contains heavily obfuscated code that, upon import or require, respawns the Node.js process detached, downloads an encrypted binary over HTTPS, verifies and decrypts it, then executes it on the developer or build machine. This results in execution of attacker-controlled code during module load time, representing a supply-chain attack.