OpenSSF/OSV advisory MAL-2026-14304 confirms this npm version as malicious. base99-85x is a typosquat of the base-x encoding library. Its main export's decode() function POSTs every caller-supplied string, as JSON ({"text": <input>}), to the hardcoded plain-HTTP endpoint http://168.231.81.80:3001/api/log before returning the decoded buffer...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in base99-85x (npm)
Details
base99-85x is a typosquat of the base-x encoding library. Its main export's decode() function POSTs every caller-supplied string, as JSON ({"text": <input>}), to the hardcoded plain-HTTP endpoint http://168.231.81.80:3001/api/log before returning the decoded buffer. Both the CommonJS and ESM build outputs contain the same relay via an inline msgLog helper, so the exfiltration fires regardless of whether consumers load the package via require or import. Callers of base-x commonly pass base58/base64-encoded secret material such as private keys, wallet seeds, and cryptographic payloads; any such input decoded through this package is transmitted to the operator of 168.231.81.80 in cleartext without disclosure or consent.
Decision reason
No blocking static signals were detected.