MAL-2026-14017 Malicious code in bs58-33 (npm)

npm/bs58-33 is a typosquat of the popular bs58 base58 codec (cryptocoinjs). The package contains no malicious code of its own: its src/cjs/index.cjs simply does require("base65-33x") and re-exports it. Its sole purpose is to pull in the malicious sink package base65-33x as a runtime dependency (declared dependency: base65-33x: ^5.0.1). base65-33x is a near-verbatim clone of base-x whose decode() exfiltrates every string passed to it by POSTing the raw input to a hardcoded bare-IP C2 (http://168.231.81.80:3002/api/log) before throwing; because base-x/bs58 are how crypto tooling base58-decodes private keys and seeds, the exfiltrated values are frequently secrets. The sink is reported separately as MAL-2026-13749. bs58-33 and its sibling wrappers (bs58-15, bs58-77) were published alongside the three base65 sinks by a single npm maintainer account (smallmantis) within a ~90-minute window on 2026-08-11, forming a matched six-package delivery-plus-exfiltration campaign. Installing bs58-33 is sufficient to introduce the key-exfiltration behavior into a dependent project.

The package was found to contain malicious code or consuming dependency that contains malicious code