Malicious code in bs58-77 (npm)
bs58-77 is a typosquat of the legitimate bs58 base58 codec package that pulls in a malicious dependency (base65-77x) designed to exfiltrate cryptographic secrets. The malicious package base65-77x intercepts base58-decoded values and POSTs them to a hardcoded C2 server before throwing an error. Six related packages were published by a single account (smallmantis) in a coordinated campaign on 2026-08-11.
- Disclosed
- Last updated
- Blast radius
- Any npm project that installed bs58-77 or its sibling packages (bs58-15, bs58-33) would have the malicious base65-77x dependency pulled in, exposing cryptographic secrets to exfiltration.
- Ecosystems
- Attack vectors
- Affected entities
- bs58-77Typosquat wrapper package that pulls in malicious base65-77x dependency
- bs58-15Sibling typosquat wrapper package
- bs58-33Sibling typosquat wrapper package
- base65-77xMalicious sink package that exfiltrates decoded strings to C2 server
bs58-77 is a typosquat of the popular bs58 base58 codec library used in cryptocurrency tooling. The package itself contains no direct malicious code; instead, it simply requires and re-exports the malicious package base65-77x as a runtime dependency (declared as base65-77x: ^5.0.1).\n\nbase65-77x is a near-verbatim clone of the legitimate base-x library. Its decode() function intercepts all input strings, exfiltrates them by POSTing to a hardcoded C2 server at http://46.250.253.63:3000/api/log, and then throws an error. Because bs58/base-x are commonly used to base58-decode private keys and cryptocurrency seeds, the exfiltrated values frequently contain cryptographic secrets.\n\nbs58-77 and two sibling wrapper packages (bs58-15, bs58-33) were published alongside three base65 sink variants by a single npm account (smallmantis) within a ~90-minute window on 2026-08-11, forming a coordinated multi-package delivery and exfiltration campaign. Installing bs58-77 is sufficient to introduce the key-exfiltration behavior into any dependent project.
Indicators of compromise
- Packages
- bs58-77
- bs58-15
- bs58-33
- base65-77x
- IPs
- 46.250.253.63
Remediation
- Immediately remove bs58-77, bs58-15, and bs58-33 from all package.json files and lock files
- Remove base65-77x and any related base65 sink packages from dependencies
- Audit npm install logs to identify all projects that installed these packages
- For any project that installed these packages, assume all base58-decoded values (especially private keys and seeds) may have been exfiltrated to the C2 server
- Rotate all cryptographic secrets (private keys, seeds, API keys) that may have been processed by affected code
- Use the legitimate bs58 package from the cryptocoinjs organization instead
- Implement npm package name verification and typosquat detection in your dependency management process
Sources
- GitHub Advisory GHSA-qm5j-29vw-2w4v · GitHub Advisory Database
Cite this entry
"Malicious code in bs58-77 (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 11, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-bs58-77-npm-nsg26v
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in wct-st (npm)
The npm package wct-st contained malicious code in its postinstall lifecycle script that collected and exfiltrated host identifiers to a remote endpoint. The package name resembles the deprecated web-component-tester, consistent with a typosquatting attack.
npmCompromised packageTyposquatting