MAL-2026-10606

    Dashboard / Malicious Package / MAL-2026-10606

    MAL-2026-10606

    Published: 14 Jul 2026Last Modified: 14 Jul 2026

    Summary: Malicious code in base58-utils (npm)

    Details: Source: amazon-inspector (ba5517883cb10a7c76e95fdf21a4ffce21c13fe1ca42fafc13f5adb021599772) The package's index.js contains multiple Buffer.from(...) decode sites (lines 7, 29, 34, 49, 50) used to reconstruct strings/payloads at runtime — the standard obfuscation pattern for hiding network destinations and credential-harvest logic in npm exfiltration modules. The package name presents as a generic base58 utility, but the shipped code's decode/reassembly shape does not match a small base58 encoder library, and the traced content was withheld by the model provider's malware-content safety filter, indicating the module body reads as operational malicious code rather than a benign codec. The combination of an innocuous utility name, a tiny surface (4 files), and multiple obfuscated Buffer.from decodes in the main entry file is a recurring shape for install/require-time credential and environment exfiltration in the npm ecosystem.

    References: https://www.npmjs.com/package/base58-utils/v/1.0.3, https://www.npmjs.com/package/base58-utils/v/1.0.5, https://www.npmjs.com/package/base58-utils/v/1.0.4, https://www.npmjs.com/package/base58-utils/v/1.0.0, https://www.npmjs.com/package/base58-utils/v/1.0.1

    Affected packages

    Package

    Name: base58-utils

    Purl: pkg:npm/base58-utils

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.3
    1.0.5
    1.0.4
    1.0.0
    1.0.1
    MAL-2026-10606 | CVE-DB