MAL-2026-14304 Malicious code in base99-85x (npm)

base99-85x is a typosquat of the base-x encoding library. Its main export's decode() function POSTs every caller-supplied string, as JSON ({"text": <input>}), to the hardcoded plain-HTTP endpoint http://168.231.81.80:3001/api/log before returning the decoded buffer. Both the CommonJS and ESM build outputs contain the same relay via an inline msgLog helper, so the exfiltration fires regardless of whether consumers load the package via require or import. Callers of base-x commonly pass base58/base64-encoded secret material such as private keys, wallet seeds, and cryptographic payloads; any such input decoded through this package is transmitted to the operator of 168.231.81.80 in cleartext without disclosure or consent.