Malicious code in base65-15x (npm)
base65-15x is a typosquat of the base-x npm package containing malicious code in its decode() function that exfiltrates caller-supplied arguments (including cryptographic secrets) to a hardcoded attacker-controlled IP endpoint via unencrypted HTTP.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer of base65-15x that calls decode() with sensitive data (keys, wallet addresses, mnemonics, etc.)
- Ecosystems
- Attack vectors
- Affected entities
- base65-15xTyposquat of base-x package; malicious decode() function exfiltrates caller-supplied arguments to attacker-controlled endpoint
base65-15x is a typosquatting attack targeting the legitimate base-x npm package. The malicious package contains a modified decode() function in both its CommonJS and ESM builds that does not perform base decoding as expected.
Instead of decoding, the function POSTs the caller-supplied string argument to the hardcoded endpoint http://46.250.253.63:3000/api/log over plain HTTP and then throws an error. This design silently exfiltrates sensitive data to an attacker-controlled host.
Consumers of base-x routinely pass encoded cryptographic material to decode(), including private keys, wallet addresses, mnemonics, and other secrets. Any code that resolves base65-15x in place of base-x will unknowingly forward these values to the attacker.
The malicious code was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- base65-15x
- IPs
- 46.250.253.63
Remediation
- Remove base65-15x from all dependencies immediately
- Audit package.json and lock files for presence of base65-15x
- Verify that base-x (the legitimate package) is installed instead
- If base65-15x was installed, assume any secrets passed to decode() have been compromised and rotate cryptographic keys, wallet addresses, and other sensitive material
- Review npm audit and dependency scanning tools to detect typosquats of critical packages
Sources
- GitHub Advisory GHSA-m962-7hqx-p4h8 · GitHub Advisory Database
Cite this entry
"Malicious code in base65-15x (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 11, 2026; last updated August 11, 2026. https://supplychainattack.org/incident/malicious-code-in-base65-15x-npm-1hx0ne
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in crypto-javas (npm)
The npm package crypto-javas contains malicious code in its postinstall hook and main entrypoint that harvests environment variables (including CI secrets like AWS_*, GITHUB_TOKEN, NPM_TOKEN) and exfiltrates them to an attacker-controlled backend. The package is presented deceptively as @wizlabs/js-crypto with a placeholder repository.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in react-dom-helpers (npm)
The npm package react-dom-helpers, a typosquat of the legitimate react-dom, contained malicious code that exfiltrated host identifiers (local IPv4 addresses, public IP, and system information) to a hardcoded Slack webhook on module load.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in localize-extract (npm)
localize-extract@1.0.0 on npm contained malicious postinstall code that exfiltrated host identifiers to an attacker-controlled endpoint. The package name resembled @angular/localize, suggesting a dependency-confusion or typosquatting attack.
npmCompromised packageTyposquattingDependency confusion - containedcritical
Malicious code in postcss-initialize-provider (npm)
postcss-initialize-provider@3.0.4 on npm contains malicious obfuscated code that typosquats the legitimate postcss-initial package. The payload captures require and module globals, queries Ethereum RPC endpoints for attacker-controlled data, and executes it via child_process.
npmCompromised packageTyposquatting