OpenSSF/OSV advisory MAL-2026-13746 confirms this npm version as malicious. The package name base65-12x typosquats the popular base-x base-encoding library and reuses base-x's repository as its homepage. Both the CJS entry (index.js around line 116) and the ESM entry (src/esm/index.js around line 114) append an approximately 123 KB top-level obfuscated block after a copy of the legitimate base-x source...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in base65-12x (npm)
Details
The package name base65-12x typosquats the popular base-x base-encoding library and reuses base-x's repository as its homepage. Both the CJS entry (index.js around line 116) and the ESM entry (src/esm/index.js around line 114) append an approximately 123 KB top-level obfuscated block after a copy of the legitimate base-x source. The block installs a VM-style dispatcher on globalThis (registries named vmr_3f4688 and vmw_bf472f), manipulates Object.defineProperty and __proto__, and contains multiple fetch references, so a network-capable code path is wired up and runs unconditionally when a consumer requires or imports the package. A base-encoding library has no functional need for a large globalThis-poisoning obfuscated VM with network fetch at module top level; the payload is duplicated across both module systems so it fires for CJS and ESM consumers alike.
Decision reason
No blocking static signals were detected.