Malicious code in base65-12x (npm)
The npm package base65-12x is a typosquatting attack on the popular base-x library. It contains obfuscated malicious code that installs a VM-style dispatcher on globalThis with network fetch capabilities, executing unconditionally at module load time in both CommonJS and ESM contexts.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer of base65-12x package
- Ecosystems
- Attack vectors
- Affected entities
- base65-12xTyposquatting package impersonating base-x
The package base65-12x on npm is a typosquatting attack targeting the legitimate base-x base-encoding library. The malicious package reuses base-x's repository URL as its homepage to increase credibility.
Both the CommonJS entry point (index.js around line 116) and the ESM entry point (src/esm/index.js around line 114) contain approximately 123 KB of obfuscated code appended after a copy of the legitimate base-x source code. This obfuscated block installs a VM-style dispatcher on the global object (with registries named vmr_3f4688 and vmw_bf472f), manipulates Object.defineProperty and proto, and includes multiple fetch references for network communication.
The malicious payload executes unconditionally at module load time when the package is required or imported, affecting both CommonJS and ESM consumers. A legitimate base-encoding library has no functional need for a globalThis-poisoning obfuscated VM with network capabilities, indicating this is intentional malicious functionality.
The incident was identified by the OpenSSF's malicious-packages project and reported via GitHub Security Advisory GHSA-q6r6-qrfx-v3wp.
Indicators of compromise
- Packages
- base65-12x
Remediation
- Remove base65-12x from all dependencies immediately
- Audit package.json and lock files for any installations of base65-12x
- Use the legitimate base-x package instead
- Review any systems that may have executed code from base65-12x for signs of compromise
- Implement dependency scanning and typosquatting detection in your supply chain security tooling
Sources
- GitHub Advisory GHSA-q6r6-qrfx-v3wp · GitHub Advisory Database
Cite this entry
"Malicious code in base65-12x (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 11, 2026; last updated August 11, 2026. https://supplychainattack.org/incident/malicious-code-in-base65-12x-npm-1yzwbw
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in tyepescript-cli (npm)
tyepescript-cli, a typosquat of the legitimate typescript package on npm, contains malicious postinstall code that downloads and executes a Windows binary (main.exe) and beacons to an attacker-controlled server. The package uses XOR obfuscation to hide URLs, commands, and IP addresses, with special logic to target both Windows and WSL environments.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in comander-lib (npm)
comander-lib@1.0.0 is a typosquat of the legitimate `commander` package containing malicious code. The package's postinstall script exfiltrates system information to a C2 server and downloads and executes a Windows payload, with capability to escape WSL/Linux sandboxes via PowerShell.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in core-js-gns (npm)
The npm package core-js-gns contained malicious code in its postinstall hook that exfiltrated system information and executed remotely-fetched Python code on developer machines. The package name was a typosquat of the legitimate core-js library.
npmCompromised packageTyposquatting - containedcritical
Malicious code in comand (npm)
The npm package 'comand' contained malicious code that executed automatically on install via postinstall.js, exfiltrating platform information and downloading an unsigned executable (main.exe) to Windows systems or via WSL PowerShell bridges. The package name appears to be a typosquat of 'command', and the GitHub owner (braz1) does not match the npm publisher.
npmCompromised packageTyposquatting