bs58-15
Base 58 encoding / decoding
This report shows the evidence for bs58-15@6.0.1, the only known version.
OpenSSF/OSV Malicious Advisory
imported 2mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-13964 confirms this npm version as malicious.
Advisory
MAL-2026-13964
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in bs58-15 (npm)
Details
Package name 'bs58-15' impersonates the widely-used 'bs58' base58 encoding library, and its package.json metadata (repository, homepage, bugs) points at the legitimate cryptocoinjs/bs58 project despite being published by an unrelated author, presenting false provenance. The package's single runtime dependency is 'base65-15x', a lookalike of the legitimate 'base-x' package. The main entry executes `require("base65-15x")` and immediately invokes the returned value as a function against an alphabet constant on module load, so any consumer that installs bs58-15 and requires it pulls attacker-named dependency code into their dependency graph and executes it at import time.
References
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
Direct inspection shows a minimal Base58 wrapper with no lifecycle execution or suspicious capabilities. Static hints referencing repository URLs and a CommonJS require are package-aligned metadata and dependency loading.
Static reason
No blocking static signals were detected.
Trigger
Consumer imports the package.
Impact
No malicious behavior established.
Mechanism
Creates a Base58 encoder/decoder from a fixed alphabet.
AI rationale
Direct inspection shows a minimal Base58 wrapper with no lifecycle execution or suspicious capabilities. Static hints referencing repository URLs and a CommonJS require are package-aligned metadata and dependency loading.
Evidence
package.jsonsrc/cjs/index.cjssrc/esm/index.jsREADME.md
Independent scan evidence
public snapshotAI called this Clean at 99.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json defines no preinstall, install, postinstall, or prepare lifecycle hook.
- Entrypoints only import base65-15x and instantiate it with a fixed Base58 alphabet.
- No filesystem, environment, network, shell, eval, or persistence behavior was found in package source.
Behavioral surface
HighEntropyStrings
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
2 Low
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to bs58-15@6.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing bs58-15@6.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.