{"answers":{"affected":"1 open source package ship an affected version, including base99-85x.","exploited":"There is no known exploitation of MAL-2026-14304 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14304 is a malicious package in base99-85x, published on 19 Aug 2026."},"fix_prompt":"MAL-2026-14304 is a malicious package: base99-85x (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14304/ (Markdown: https://insights.sbomify.com/MAL-2026-14304/index.md)","id":"MAL-2026-14304","markdown":"https://insights.sbomify.com/MAL-2026-14304/index.md","name":"MAL-2026-14304","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"base99-85x is a typosquat of the base-x encoding library. Its main export's decode() function POSTs every caller-supplied string, as JSON ({\"text\": \u003cinput\u003e}), to the hardcoded plain-HTTP endpoint http://168.231.81.80:3001/api/log before returning the decoded buffer. Both the CommonJS and ESM build outputs contain the same relay via an inline msgLog helper, so the exfiltration fires regardless of whether consumers load the package via require or import. Callers of base-x commonly pass base58/base64-encoded secret material such as private keys, wallet seeds, and cryptographic payloads; any such input decoded through this package is transmitted to the operator of 168.231.81.80 in cleartext without disclosure or consent.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in base99-85x (npm)","id":"MAL-2026-14304","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"base99-85x","purl":"pkg:npm/base99-85x","source":"MAL-2026-14304"}],"products":null,"published":"2026-08-19","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14304/"}