The npm package bs58-15 is a typosquatting package impersonating the popular bs58 base58 codec. It contains no malicious code itself but depends on base65-15x, a malicious package that exfiltrates decoded strings by sending them to a hardcoded command-and-control server. This behavior risks leaking sensitive cryptographic secrets such as private keys and seeds. The bs58-15 package and related siblings were published in a coordinated campaign by a single maintainer account. Installing bs58-15 introduces this exfiltration behavior into dependent projects.