GCVE-110-OSM-2026-10232

This looks like a malicious supply-chain implant masquerading as a base-encoding library: the attacker model is a burner-account publisher shipping a trojanized dependency to exfiltrate data from consumers. The legitimate `base-x` code is modified so `decode(string)` silently calls `msgLog(string)` and POSTs every decoded input to a hard coded IP address which the IOC classifier marks as C2. The same beacon appears in both `src/cjs/index.cjs` and `src/esm/index.js`, and the publisher metadata (`smallmantis`, brand-new account, burner-pattern, single version) strongly supports malicious intent rather than a false positive. This is consistent with credential or token harvesting from application inputs passed through the decode path. ENTRY src/cjs/index.cjs (main: src/cjs/index.cjs) DESTINATION - 2 c2 (ipv4, urls) (values recorded in verified_iocs) EXFIL - Suspicious Domain in src/cjs/index.cjs: "http://46.250.253.63" - Suspicious Domain in src/esm/index.js: "http://46.250.253.63" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern