The typescript-base58 package version 1.0.0 on npm is a malicious package that acts as a one-line re-export of another package base58-core. It misleadingly advertises zero dependencies while actually introducing base58-core as a runtime dependency. The package itself does not perform malicious actions directly, but the risk comes from the base58-core package it depends on, which is not analyzed here. Any system with this package installed should be considered fully compromised, and all secrets and keys must be rotated immediately. Removal of the package does not guarantee full remediation due to potential persistent compromise.