Malicious code in bs58-15 (npm)
The npm package bs58-15 is a typosquat impersonating the legitimate bs58 base58 encoding library, with false provenance metadata pointing to the cryptocoinjs/bs58 project. It contains a malicious runtime dependency (base65-15x) that executes attacker code on module import.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer that installed bs58-15
- Ecosystems
- Attack vectors
- Affected entities
- bs58-15Malicious typosquat package impersonating bs58
- base65-15xLookalike dependency injected by bs58-15
The npm package bs58-15 was published as a typosquat of the widely-used bs58 base58 encoding library. The package's metadata (repository, homepage, bugs fields) falsely points to the legitimate cryptocoinjs/bs58 project despite being published by an unrelated author, creating false provenance.
The package's sole runtime dependency is base65-15x, a lookalike of the legitimate base-x package. The main entry point immediately requires and invokes base65-15x as a function against an alphabet constant, causing attacker-controlled code to execute at module load time.
Any consumer installing bs58-15 and requiring it would pull the malicious base65-15x dependency into their dependency graph and execute its code on import, potentially compromising the consumer's application or build environment.
The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- bs58-15
- base65-15x
Remediation
- Remove bs58-15 from all package.json files and lock files
- Audit dependency trees for presence of bs58-15 or base65-15x
- Replace with the legitimate bs58 package from the cryptocoinjs/bs58 project
- Review application logs and environment for signs of compromise during the period bs58-15 was installed
- Regenerate any secrets or credentials that may have been exposed during execution of malicious code
Sources
- GitHub Advisory GHSA-pc6p-3869-9j4f · GitHub Advisory Database
Cite this entry
"Malicious code in bs58-15 (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-bs58-15-npm-djzhpr
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in wct-st (npm)
The npm package wct-st contained malicious code in its postinstall lifecycle script that collected and exfiltrated host identifiers to a remote endpoint. The package name resembles the deprecated web-component-tester, consistent with a typosquatting attack.
npmCompromised packageTyposquatting