OSV ID
MAL-2026-11023
Ecosystem
npm
Summary
Package bs58-88 mimics the popular bs58 base58 encoder: README, keywords, and repository URL match the real bs58 , and index.cjs re-exports functionality via require("base65-85x") . The sole runtime dependency base65-85x is itself a name that resembles the legitimate base-x package. The package under review does not contain traced installer-harm behavior (no exfiltration, no install-time fetch-and-execute, no credential access, no lifecycle scripts observed), so the concern is name-confusion plus a look-alike transitive rather than a demonstrated payload in this artifact. Whether base65-85x is itself malicious was not established here; a human reviewer should assess both the name-similarity judgment against bs58 / base-x and the trust of the base65-85x dependency before publishing a public advisory.
Source: amazon-inspector (b6d1dec3ae934b73d28ddd4c002cf93f9a9be597731434f5cfead7fdbb11954f)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.