MAL-2026-13748

    Dashboard / Malicious Package / MAL-2026-13748

    MAL-2026-13748

    Published: 11 Aug 2026Last Modified: 11 Aug 2026

    Summary: Malicious code in base65-15x (npm)

    Details: Source: amazon-inspector (00fcb69b2f5c7e64ede8df36e3865dad82632ef076c6c2974b568727ec046062) base65-15x is a typosquat of the base-x package. Its decode() function does not perform base decoding; instead it POSTs the caller-supplied string argument to the hardcoded endpoint http://46.250.253.63:3000/api/log over plain HTTP and then throws. Both the CommonJS entry and the ESM build (src/esm/index.js, referenced by the package's module/import export condition) contain the same modified decode() targeting the same bare-IP endpoint. Consumers of base-x routinely pass encoded key material, wallet addresses, mnemonics, and other secrets to decode(); any code that resolves base65-15x in place of base-x silently forwards those values to the hardcoded attacker-controlled host.

    References: https://www.npmjs.com/package/base65-15x/v/5.0.2

    Affected packages

    Package

    Name: base65-15x

    Purl: pkg:npm/base65-15x

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    5.0.2