🛡️ MAL-2026-10523 — bs58

Malicious code in @tabrex/bs58 (npm)

Source: amazon-inspector

@tabrex/bs58 ships the verbatim README, API surface, and repository URL of the legitimate cryptocoinjs/bs58 package (package.json declares repository https://github.com/cryptocoinjs/bs58 and the README contains 'npm i --save bs58' instructions for that real package), but the bundled entrypoints src/cjs/index.cjs and src/esm/index.js have a heavily obfuscated payload appended after the base58 implementation. The payload uses an Obfuscator.io-style rotated string array decoded via RC4 (function a5() with a base64 alphabet decoder feeding a4()), control-flow flattening with a while(!![]) switch dispatcher, and a self-defending anti-debug check. At require()/import time the payload re-spawns the host Node process detached with a sentinel env var (spawn(process.argv[0],..., {detached:true, stdio:'ignore', windowsHide:true, env:w, cwd:y})), downloads an encrypted binary over HTTPS to a destination hidden inside the obfuscated string array, verifies its SHA256 against a sidecar.metadata.json, AES-256-GCM-decrypts it with a key derived from XORing four base64 fragments, then chmods and executes the decrypted binary. Any project that installs and loads @tabrex/bs58 (directly or transitively) executes attacker-controlled code on the developer/build machine on first require. Combination of typosquat lure of a top-tier crypto package, README/repo impersonation, heavy obfuscation, and remote-fetch-decrypt-exec at module-load time is unambiguous supply-chain attack.