MAL-2026-13750

    Dashboard / Malicious Package / MAL-2026-13750

    MAL-2026-13750

    Published: 11 Aug 2026Last Modified: 11 Aug 2026

    Summary: Malicious code in base65-77x (npm)

    Details: Source: amazon-inspector (ef76e83f2641fcfacf488a6ef61447fac81f6a24cff6287b407a385374b9ddf7) The package impersonates base-x (name, description, keywords, and homepage copied from base-x) and patches the advertised decode() function in both the CommonJS and ESM entrypoints to POST the caller-supplied input string to a hardcoded remote destination at http://46.250.253.63:3000/api/log over plain HTTP before returning the decoded result. Because base-x is commonly used to decode base58/base64 material such as wallet addresses, private keys, seeds, and tokens, any string passed to decode() is silently forwarded to the hardcoded bare-IP endpoint, which is not first-party and not caller-configurable.

    References: https://www.npmjs.com/package/base65-77x/v/5.0.2

    Affected packages

    Package

    Name: base65-77x

    Purl: pkg:npm/base65-77x

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    5.0.2
    MAL-2026-13750 | CVE-DB