{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "dist/index.cjs",
              "sha256": "0883f67f12ef0c2b1da1e11a4d31a08fdaedc5c7de0db2fb98cb6f7e5efd3224",
              "tlsh": "281251a82af754a0c223b0ad435f90127539f153390ddd68be0ce7841fa597857e37ae"
            },
            {
              "path": "dist/index.js",
              "sha256": "0e9d1ba8dd0e5c06cdb94bb8eb52af519ed319df3d2faf54e063a653c6191f11",
              "tlsh": "bb1241a82af754a0c223b0ad426f90127539f153394ddd6cbe0ce7845fa153857e3bae"
            }
          ],
          "package_integrity": [
            {
              "filename": "base58-core-1.0.1.tgz",
              "hashes": {
                "sha1": "b4dd05c96809c80d69d48fdab4a25b84078da84c",
                "sha512_sri": "sha512-MI3HAkFL4EL2Xu7lTeZeTrVkkzUiwNVdkk6Z4xzybU39RFmo0BvZIAkB1J5Yx5qkX5mgYzOeNvJFwgrEJZMFcA=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "base58-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": [
        "1.0.1",
        "1.0.0",
        "1.0.2",
        "1.0.3",
        "1.0.5",
        "1.0.4",
        "1.0.7",
        "1.0.8",
        "1.0.6"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007492",
        "import_time": "2026-06-25T07:47:51.798999099Z",
        "modified_time": "2026-06-25T06:43:58Z",
        "sha256": "6e2594f5ee1ee71b3fb6a42fd834dee3598ce0993bd5718769dad01c916326d1",
        "source": "amazon-inspector",
        "versions": [
          "1.0.1"
        ]
      },
      {
        "id": "IN-MAL-2026-007493",
        "import_time": "2026-06-25T07:47:51.841500941Z",
        "modified_time": "2026-06-25T06:44:18Z",
        "sha256": "c10874ae13f1937b6974bcaaec72996e54f85fc3de6bf5e53d732f6e1f37c8a3",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      },
      {
        "id": "IN-MAL-2026-007635",
        "import_time": "2026-06-26T16:45:36.259224893Z",
        "modified_time": "2026-06-26T15:52:19Z",
        "sha256": "a01cd093c49b1f8e97a1a4b1f3711ee39c83235f9165cd8650cf18ff7bb56f7f",
        "source": "amazon-inspector",
        "versions": [
          "1.0.2"
        ]
      },
      {
        "id": "IN-MAL-2026-007660",
        "import_time": "2026-06-26T20:38:47.496652831Z",
        "modified_time": "2026-06-26T20:15:41Z",
        "sha256": "1b1217d46a6b8bcdefc7ac0e928e40e5e74985b4ed430870e0ce1703f0caef69",
        "source": "amazon-inspector",
        "versions": [
          "1.0.3"
        ]
      },
      {
        "id": "IN-MAL-2026-007709",
        "import_time": "2026-06-29T05:07:05.124464493Z",
        "modified_time": "2026-06-29T03:22:44Z",
        "ranges": [
          {
            "events": [
              {
                "introduced": "0"
              }
            ],
            "type": "SEMVER"
          }
        ],
        "sha256": "0081cc9c4152afede923a3e8ee9eb2116b32c02b7f355edbd411f23b2e67273c",
        "source": "amazon-inspector",
        "versions": [
          "1.0.5"
        ]
      },
      {
        "id": "IN-MAL-2026-007708",
        "import_time": "2026-06-29T05:07:05.009040945Z",
        "modified_time": "2026-06-29T03:22:37Z",
        "ranges": [
          {
            "events": [
              {
                "introduced": "0"
              }
            ],
            "type": "SEMVER"
          }
        ],
        "sha256": "68c7a1f450b6c157edaef60638c547dfb284623a9a77e27a0abc9ebfaff87d83",
        "source": "amazon-inspector",
        "versions": [
          "1.0.4"
        ]
      },
      {
        "id": "IN-MAL-2026-007840",
        "import_time": "2026-07-01T19:11:22.539799474Z",
        "modified_time": "2026-07-01T18:34:12Z",
        "sha256": "11db28718aa0b66d4fd60e20b771e15b5d6105966450c67723397b74bc59bd32",
        "source": "amazon-inspector",
        "versions": [
          "1.0.7"
        ]
      },
      {
        "id": "IN-MAL-2026-007841",
        "import_time": "2026-07-01T19:11:22.652678448Z",
        "modified_time": "2026-07-01T18:34:20Z",
        "sha256": "547f3bde449b07eb12b34eefeb82df3c8994111951215f2870606b6a72d433b0",
        "source": "amazon-inspector",
        "versions": [
          "1.0.8"
        ]
      },
      {
        "id": "IN-MAL-2026-007837",
        "import_time": "2026-07-01T19:11:22.015805925Z",
        "modified_time": "2026-07-01T18:33:47Z",
        "sha256": "fd61d8ee71e80b258f57bd2c02e48e132cd021a8fb4dbcf456e6a4ab63af73d0",
        "source": "amazon-inspector",
        "versions": [
          "1.0.6"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0081cc9c4152afede923a3e8ee9eb2116b32c02b7f355edbd411f23b2e67273c)\nbase58-core@1.0.5 presents itself as a base58 encoding library (README markets it as @base58/core, public API mimics bs58/@scure/base) but on require of dist/index.js it arms a time-bombed payload that activates 72 hours after install. After activation, a 2.5s timer polls the OS clipboard, detects BTC/ETH/SOL addresses, and silently replaces them with attacker-controlled wallet addresses (bc1qjft978uykglsh0adcyx6xhkes56vqzs3fual3l, 0xd63eD44065eDb1e2ad2519B011c06412dA7B7c5B, A7ajd7W5WYdrnkeaiBRjVoK6uBEDvgnuZcpzQXqo18Ph), redirecting any outgoing crypto transfer made by a user on the installer\u0027s machine to the attacker. When clipboard contents match wallet addresses, WIF/hex private keys, or BIP-39 seed phrases, the package POSTs the matches together with hostname, platform, cwd, and up to 2000 chars of clipboard content to a hardcoded bare-IP endpoint at http://2.27.62.51:8080/api/health (with:8081 as backup) over plain HTTP. For persistence, it appends a hook to ~/.bashrc, ~/.zshrc, and ~/.profile that re-invokes the payload via `node -e \"require(\u0027@base58/core\u0027)._internal.activate()\"` on every shell, and on Windows drops base58-runtime.js into the Startup folder, ensuring the clipper survives reboots and host-process exits. The 72-hour activation delay and powershell-based execSync calls are anti-analysis measures to evade sandbox/CI review. Installer impact is direct financial theft (crypto-address substitution), credential/seed-phrase theft (clipboard exfiltration), and persistent compromise of the developer\u0027s shell environment.\n",
  "id": "MAL-2026-6445",
  "modified": "2026-07-01T19:13:16Z",
  "published": "2026-06-25T06:43:58Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/base58-core/v/1.0.1"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/base58-core/v/1.0.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/base58-core/v/1.0.2"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/base58-core/v/1.0.3"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/base58-core/v/1.0.5"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/base58-core/v/1.0.4"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/base58-core/v/1.0.7"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/base58-core/v/1.0.8"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/base58-core/v/1.0.6"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in base58-core (npm)"
}