CLSA-2026-1791197262 TuxCare security update for base-x (1 CVE)

TuxCare rebuilt base-x to address 1 CVE. Fixed in 2.0.6-tuxcare.1...

MAL-2026-13750 Malicious code in base65-77x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef76e83f2641fcfacf488a6ef61447fac81f6a24cff6287b407a385374b9ddf7 The package impersonates base-x name, description, keywords, and homepage copied from base-x and patches the advertised decode function in both the...

Malicious code in base-x-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02b128e2527188695a34b319908cae8e30d328c4ac38be36cdbb0957af15e443 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11246 Malicious code in base-x-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02b128e2527188695a34b319908cae8e30d328c4ac38be36cdbb0957af15e443 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in base65-85x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d94610a3e8258b4f3f141cda2ade7a2bdeafbf9f8c1a9251d72c8b0c6dd4cff0 Package name base65-85x impersonates the widely-used base-x encoding library, with package.json copying base-x's homepage, bugs.url, and repository.u...

Malicious code in bs58-86 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 057e2e470e0bc9dbfd2ff37955c0c7d051cca944025b9d62c882ffc98c4434e5 Package [email protected] reproduces the name, README, repository URL cryptocoinjs/bs58, and exported API of the widely-used bs58 base58 encoding library...

Malicious code in base-x-64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2486f9bad36944300cb58e1a73a370afef7be10040daf814861d1b1a6287cdb8 The package base-x-64 was found to contain malicious code. Source: ghsa-malware d09ca9d36cb3821dc878f97db3b7e8ddef6f5f8e390373492186d10b668718f3 Any...

MAL-2026-2320 Malicious code in base-x-64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2486f9bad36944300cb58e1a73a370afef7be10040daf814861d1b1a6287cdb8 The package base-x-64 was found to contain malicious code. Source: ghsa-malware d09ca9d36cb3821dc878f97db3b7e8ddef6f5f8e390373492186d10b668718f3 Any...

base-x: base-x homograph attack allows Unicode lookalike characters to bypass validation.

A flaw was found in base-x. This vulnerability allows attackers to generate addresses that appear legitimate, tricking users into sending money to them instead of the intended ones. The problem arises from the way base-x compresses leading zeros in addresses via manipulation of the base encoding...

base-x: base-x homograph attack allows Unicode lookalike characters to bypass validation.

A flaw was found in base-x. This vulnerability allows attackers to generate addresses that appear legitimate, tricking users into sending money to them instead of the intended ones. The problem arises from the way base-x compresses leading zeros in addresses via manipulation of the base encoding...

base-x: base-x homograph attack allows Unicode lookalike characters to bypass validation.

A flaw was found in base-x. This vulnerability allows attackers to generate addresses that appear legitimate, tricking users into sending money to them instead of the intended ones. The problem arises from the way base-x compresses leading zeros in addresses via manipulation of the base encoding...

CVE-2025-27611 base-x homograph attack allows Unicode lookalike characters to bypass validation.

base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression. Versions 4.0.0, 5.0.0, and all prior to 3.0.11, are vulnerable to attackers potentially deceiving users into sending funds to an unintended address. This issue has been patched in versions...

CVE-2025-27611 base-x homograph attack allows Unicode lookalike characters to bypass validation.

base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression. Versions 4.0.0, 5.0.0, and all prior to 3.0.11, are vulnerable to attackers potentially deceiving users into sending funds to an unintended address. This issue has been patched in versions...

org.webjars.npm:bitcore-lib (0.15.0), org.webjars.npm:bitcore-mnemonic (1.5.0) +5 more potentially affected by CVE-2025-27611 via org.webjars.npm:base-x (3.0.8)

org.webjars.npm:base-x MAVEN version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:base-x and may be impacted: - org.webjars.npm:bitcore-lib 0.15.0 - org.webjars.npm:bitcore-mnemonic 1.5.0 - org.webjars.npm:bs58 4.0.1 -...

Insufficient Visual Distinction of Homoglyphs Presented to User

Overview org.webjars.npm:base-x is a Fast base encoding / decoding of any given alphabet Affected versions of this package are vulnerable to Insufficient Visual Distinction of Homoglyphs Presented to User through the validation process. An attacker can deceive users into sending funds to an...

CVE-2025-27611

base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression. Versions 4.0.0, 5.0.0, and all prior to 3.0.11, are vulnerable to attackers potentially deceiving users into sending funds to an unintended address. This issue has been patched in versions...

CVE-2025-27611 base-x homograph attack allows Unicode lookalike characters to bypass validation.

base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression. Versions 4.0.0, 5.0.0, and all prior to 3.0.11, are vulnerable to attackers potentially deceiving users into sending funds to an unintended address. This issue has been patched in versions...

@acala-network/api (>=0.2.0-beta.1, <=0.2.0-beta.8), @acala-network/types (>=0.2.0-beta.1, <=0.2.0-beta.8) +403 more potentially affected by CVE-2025-27611 via base-x (>=3.0.0, <=3.0.10)

base-x NPM version =3.0.0, =0.2.0-beta.1, =0.2.0-beta.1, =0.1.2, =0.3.7, =0.1.7, =1.0.0, =1.0.0, =1.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.4 and more Source cves: CVE-2025-27611 Source advisory: OSV:GHSA-XQ7P-G2VC-G82P...

@1tokenfe/cross-inpage-provider-injected (2.2.46), @1tokenfe/inpage-providers-hub (2.2.46) +129 more potentially affected by CVE-2025-27611 via base-x (4.0.0)

base-x NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on base-x and may be impacted: - @1tokenfe/cross-inpage-provider-injected 2.2.46 - @1tokenfe/inpage-providers-hub 2.2.46 - @1tokenfe/onetoken-alph-provider 2.2.46 -...

@astrobase/core (>=0.2.0, <=0.4.0), @indiebackend/domain-ids (>=0.0.1, <=1.0.3) +2 more potentially affected by CVE-2025-27611 via base-x (5.0.0)

base-x NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on base-x and may be impacted: - @astrobase/core =0.2.0, =0.0.1, =0.0.11, =0.5.0, =0.5.15 Source cves: CVE-2025-27611 Source advisory: OSV:GHSA-XQ7P-G2VC-G82P...