Malicious code in base65-13x (npm)

base65-13x@5.0.2 is a malicious npm package that impersonates the legitimate cryptocoinjs/base-x library by reusing its README, homepage, and API surface. However, the exported decode(string) function contains a ~123KB obfuscated payload using rotated identifiers (vmR, vmr_92f1a9, vmw_4ee781) built via Object.defineProperty.\n\nThe obfuscated blob contains multiple references to the Function constructor and fetch, indicating dynamic code construction and outbound network I/O capabilities. The destination hosts and constructed code are concealed by the obfuscation and are not statically visible. In contrast, the genuine base-x library is approximately 50 lines of pure arithmetic with no obfuscation and no network activity.\n\nAny consumer invoking decode() on this package will execute the packed VM, which dynamically constructs and executes code with fetch capability. The incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages repository.