If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
npm/bs58-15 is a typosquat of the popular bs58 base58 codec (cryptocoinjs). The package contains no malicious code of its own: its src/cjs/index.cjs simply does require("base65-15x") and re-exports it. Its sole purpose is to pull in the malicious sink package base65-15x as a runtime dependency (declared dependency: base65-15x: ^5.0.1). base65-15x is a near-verbatim clone of base-x whose decode() exfiltrates every string passed to it by POSTing the raw input to a hardcoded bare-IP C2 (http://46.250.253.63:3000/api/log) before throwing; because base-x/bs58 are how crypto tooling base58-decodes private keys and seeds, the exfiltrated values are frequently secrets. The sink is reported separately as MAL-2026-13748. bs58-15 and its sibling wrappers (bs58-33, bs58-77) were published alongside the three base65 sinks by a single npm maintainer account (smallmantis) within a ~90-minute window on 2026-08-11, forming a matched six-package delivery-plus-exfiltration campaign. Installing bs58-15 is sufficient to introduce the key-exfiltration behavior into a dependent project.
---
_-= Per source details. Do not edit below this line.=-_
Source: amazon-inspector (99502d2feb4743e651628a07ca032fa0cc813ff6482cae15d9c2f1fb6fce63c4)
Package name 'bs58-15' impersonates the widely-used 'bs58' base58 encoding library, and its package.json metadata (repository, homepage, bugs) points at the legitimate cryptocoinjs/bs58 project despite being published by an unrelated author, presenting false provenance. The package's single runtime dependency is 'base65-15x', a lookalike of the legitimate 'base-x' package. The main entry executes `require("base65-15x")` and immediately invokes the returned value as a function against an alphabet constant on module load, so any consumer that installs bs58-15 and requires it pulls attacker-named dependency code into their dependency graph and executes it at import time.