MAL-2026-14017 Malicious code in bs58-33 (npm)

npm/bs58-33 is a typosquat of the popular bs58 base58 codec cryptocoinjs. The package contains no malicious code of its own: its src/cjs/index.cjs simply does require"base65-33x" and re-exports it. Its sole purpose is to pull in the malicious sink package base65-33x as a runtime dependency declar...

bs58-33 (6.0.1) potentially affected by unknown CVE via base65-33x (5.0.2)

base65-33x NPM version 5.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on base65-33x and may be impacted: - bs58-33 6.0.1 Source cves: unknown CVE Source advisory: SNYK:JS-BASE6533X-18616644...

bs58-33 (6.0.1) potentially affected by unknown CVE via base65-33x (5.0.2)

base65-33x NPM version 5.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on base65-33x and may be impacted: - bs58-33 6.0.1 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13749...