# MAL-2026-13964: Malicious code in bs58-15 (npm)


- **Type:** Malicious package
- **Package:** `bs58-15` (npm)
- **Published:** 13 Aug 2026

## What is MAL-2026-13964?

MAL-2026-13964 is a malicious package in bs58-15, published on 13 Aug 2026. 

### Official description

npm/bs58-15 is a typosquat of the popular bs58 base58 codec (cryptocoinjs). The package contains no malicious code of its own: its src/cjs/index.cjs simply does require("base65-15x") and re-exports it. Its sole purpose is to pull in the malicious sink package base65-15x as a runtime dependency (declared dependency: base65-15x: ^5.0.1). base65-15x is a near-verbatim clone of base-x whose decode() exfiltrates every string passed to it by POSTing the raw input to a hardcoded bare-IP C2 (http://46.250.253.63:3000/api/log) before throwing; because base-x/bs58 are how crypto tooling base58-decodes private keys and seeds, the exfiltrated values are frequently secrets. The sink is reported separately as MAL-2026-13748. bs58-15 and its sibling wrappers (bs58-33, bs58-77) were published alongside the three base65 sinks by a single npm maintainer account (smallmantis) within a ~90-minute window on 2026-08-11, forming a matched six-package delivery-plus-exfiltration campaign. Installing bs58-15 is sufficient to introduce the key-exfiltration behavior into a dependent project.

Package name 'bs58-15' impersonates the widely-used 'bs58' base58 encoding library, and its package.json metadata (repository, homepage, bugs) points at the legitimate cryptocoinjs/bs58 project despite being published by an unrelated author, presenting false provenance. The package's single runtime dependency is 'base65-15x', a lookalike of the legitimate 'base-x' package. The main entry executes `require("base65-15x")` and immediately invokes the returned value as a function against an alphabet constant on module load, so any consumer that installs bs58-15 and requires it pulls attacker-named dependency code into their dependency graph and executes it at import time.

## What should I do about MAL-2026-13964?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-13964 is a malicious package: bs58-15 (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-13964/ (Markdown: https://insights.sbomify.com/MAL-2026-13964/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-13964

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-13964/
Summaries are generated and may contain mistakes; the official description above is the record.