Malicious code in base65-77x (npm)

The npm package base65-77x was identified as malicious code designed to impersonate the legitimate base-x library. The package copies identifying metadata (name, description, keywords, and homepage) from base-x to increase the likelihood of installation by users seeking the legitimate library.\n\nThe malicious functionality is embedded in both CommonJS and ESM entrypoints of the decode() function. When invoked, the function silently exfiltrates the caller-supplied input string to a hardcoded remote destination at http://46.250.253.63:3000/api/log over unencrypted HTTP before returning the decoded result to the caller.\n\nBecause base-x is commonly used to decode base58/base64 material such as cryptocurrency wallet addresses, private keys, seeds, and authentication tokens, any sensitive data passed to the compromised decode() function would be forwarded to the attacker-controlled endpoint. The remote IP and port are hardcoded and not configurable by the caller.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.