The npm package base65-77x impersonates the legitimate base-x package and contains malicious code that exfiltrates input data passed to its decode() function to a remote server. This package silently sends potentially sensitive data such as wallet addresses, private keys, seeds, and tokens to an attacker-controlled endpoint before returning the decoded result. Installation or use of this package compromises the host system, and all secrets on the affected system should be considered exposed and rotated immediately.