The npm package bs58-77 is a typosquatting package that does not contain malicious code itself but depends on a malicious package base65-77x. The base65-77x package exfiltrates sensitive data by sending decoded strings, often private keys or seeds, to a hardcoded command and control server. This behavior enables secret leakage when bs58-77 is installed in a project. The malicious packages were published in a coordinated campaign by a single maintainer account within a short time frame. The affected version is exactly 6.0.1.