bs58-33
Base 58 encoding / decoding
This report shows the evidence for bs58-33@6.0.1, the only known version.
OpenSSF/OSV Malicious Advisory
imported 2mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-14017 confirms this npm version as malicious.
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
Direct inspection found a minimal codec wrapper with no lifecycle scripts or concrete attack behavior. The unusual dependency name alone is insufficient to establish malicious behavior from this package's source.
Independent scan evidence
public snapshot- Both published entrypoints only create and export a Base58 codec using a fixed alphabet.
- Manifest exports only the CJS and ESM codec entrypoints and has no lifecycle hook.
Source & flagged code
1 flagged · loading sourceBoth published entrypoints only create and export a Base58 codec using a fixed alphabet.
src/esm/index.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to bs58-33@6.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing bs58-33@6.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.