bs58-77
Base 58 encoding / decoding
This report shows the evidence for bs58-77@6.0.1, the only known version.
OpenSSF/OSV Malicious Advisory
imported 2mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-14018 confirms this npm version as malicious.
Advisory
MAL-2026-14018
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in bs58-77 (npm)
Details
npm/bs58-77 is a typosquat of the popular bs58 base58 codec (cryptocoinjs). The package contains no malicious code of its own: its src/cjs/index.cjs simply does require("base65-77x") and re-exports it. Its sole purpose is to pull in the malicious sink package base65-77x as a runtime dependency (declared dependency: base65-77x: ^5.0.1). base65-77x is a near-verbatim clone of base-x whose decode() exfiltrates every string passed to it by POSTing the raw input to a hardcoded bare-IP C2 (http://46.250.253.63:3000/api/log) before throwing; because base-x/bs58 are how crypto tooling base58-decodes private keys and seeds, the exfiltrated values are frequently secrets. The sink is reported separately as MAL-2026-13750. bs58-77 and its sibling wrappers (bs58-15, bs58-33) were published alongside the three base65 sinks by a single npm maintainer account (smallmantis) within a ~90-minute window on 2026-08-11, forming a matched six-package delivery-plus-exfiltration campaign. Installing bs58-77 is sufficient to introduce the key-exfiltration behavior into a dependent project.
References
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
Source inspection shows a minimal codec wrapper with no malicious behavior or lifecycle execution. Static hints were consistent with the inspected source.
Static reason
No blocking static signals were detected.
Trigger
Consumer imports the package.
Impact
No credential access, network activity, file mutation, or command execution is established.
Mechanism
Constructs a Base58 encoder/decoder.
AI rationale
Source inspection shows a minimal codec wrapper with no malicious behavior or lifecycle execution. Static hints were consistent with the inspected source.
Evidence
package.jsonsrc/cjs/index.cjssrc/esm/index.js
Independent scan evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Manifest exposes only CJS/ESM entrypoints and has no install lifecycle hook.
- Both runtime entrypoints only create and export a Base58 codec using base65-77x.
Evidence against
Behavioral surface
HighEntropyStrings
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
32"main": "src/cjs/index.cjs",
"module": "src/esm/index.js",
"types": "src/cjs/index.d.ts",
"exports": {
".": {
"import": {
"types": "./src/esm/index.d.ts",
"default": "./src/esm/index.js"
},
"require": {
"types": "./src/cjs/index.d.cts",
"default": "./src/cjs/index.cjs"
}
}
},
"scripts": {
"build": "npm run clean && tsc -p ./tsconfig.json && tsc -p ./tsconfig.cjs.json",
"clean": "rimraf src",
"gitdiff": "npm run build && git diff --exit-code",
"postbuild": "find src/cjs -type f \\( -name \"*.js\" -o -n
High
Suspicious Lifecycle Evidence
Manifest exposes only CJS/ESM entrypoints and has no install lifecycle hook.
package.jsonView on unpkg · L32src/cjs/index.cjsView file
6var base_x_1 = __importDefault(require("base65-77x"));
var ALPHABET = '[redacted]';
exports.default = (0, base_x_1.default)(ALPHABET);
High
Ai Review Evidence
Both runtime entrypoints only create and export a Base58 codec using base65-77x.
src/cjs/index.cjsView on unpkg · L6src/esm/index.jsView file
1import basex from 'base65-77x';
var ALPHABET = '[redacted]';
export default basex(ALPHABET);
High
Ai Review Evidence
Both runtime entrypoints only create and export a Base58 codec using base65-77x.
src/esm/index.jsView on unpkg · L1Findings
3 High2 Low
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencesrc/cjs/index.cjs
HighAi Review Evidencesrc/esm/index.js
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to bs58-77@6.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing bs58-77@6.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.