If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (92b7a4319eaf4f75e0e4138802a61018a4016e0b1ff69e9e8eab51eeb01a240d)
base99-85x is a typosquat of the base-x encoding library. Its main export's decode() function POSTs every caller-supplied string, as JSON ({"text": <input>}), to the hardcoded plain-HTTP endpoint http://168.231.81.80:3001/api/log before returning the decoded buffer. Both the CommonJS and ESM build outputs contain the same relay via an inline msgLog helper, so the exfiltration fires regardless of whether consumers load the package via require or import. Callers of base-x commonly pass base58/base64-encoded secret material such as private keys, wallet seeds, and cryptographic payloads; any such input decoded through this package is transmitted to the operator of 168.231.81.80 in cleartext without disclosure or consent.