base65-13x @5.0.2

Summary

base65-13x@5.0.2 impersonates cryptocoinjs/base-x, reusing its README, homepage, and API surface, but the exported decode(string) function in both src/esm/index.js (line 114) and src/cjs/index.cjs (line 116) contains a ~123KB VM-style obfuscated payload using rotated identifiers (vmR, vmr_92f1a9, vmw_4ee781) built via Object.defineProperty. The blob contains multiple references to the Function constructor and fetch, indicating dynamic code construction and outbound network I/O. Genuine base-x is roughly 50 lines of pure arithmetic with no obfuscation and no network activity. Any consumer invoking decode() on this package executes the packed VM, which dynamically constructs code with fetch capability. The destination hosts and constructed code are concealed by the obfuscation and are not statically visible.

Source: amazon-inspector (59226f2c38efcc1dd5de6423edfc866125564cd726915307d7a05ca5b5f13529)