The npm package bs58-11 is a malicious package published under a name resembling the legitimate bs58 module. It contains a minimal wrapper that requires another suspicious dependency, base65-11x, which is not included in the tarball. The package itself does not contain direct malicious code, but the included dependency may execute harmful actions. Any system with this package installed should be considered fully compromised, and all secrets and keys must be rotated immediately. Removal of the package alone may not eliminate all malicious software resulting from its installation.