Threats Tagged 'mal-2026-13745'

The npm package base65-11x is a malicious lookalike of the legitimate base-x encoder package. It contains a large obfuscated payload embedded in both CommonJS and ESM entrypoints that executes automatically upon import or require. This payload is concealed inside a custom virtual machine interpreter, making static analysis difficult. Installing or running this package can lead to full system compromise, and all secrets and keys on the affected system should be considered exposed and rotated immediately. Removal of the package alone may not eliminate the threat due to potential persistence mechanisms.