base65-33x@5.0.2

No blocking static signals were detected.

A consumer calls the exported decoder's decode(string) method.

Potential exfiltration of any encoded secrets, tokens, or application data passed to decode().

Silent HTTP POST of decoder input

The package presents as a base-encoding library, but its normal decode() path asynchronously POSTs the caller-provided input to a hard-coded IP address before returning the decoded bytes. The behavior exists in both package entrypoints and is unrelated to local encoding functionality.

Source inspection confirms a concrete runtime data-exfiltration path in both distributed entrypoints. The absence of install hooks does not mitigate the malicious library-call behavior.