The npm package base65-33x (version 5.0.2) contains malicious code that exfiltrates data. Its decode function sends any input it receives to an attacker-controlled IP address over plain HTTP before returning the decoded result. This behavior risks leaking sensitive cryptographic secrets such as wallet keys. Systems with this package installed should be considered fully compromised, and all secrets should be rotated immediately from a clean environment.