GCVE-110-OSM-2026-10233

This looks like a supply-chain trojan masquerading as the legitimate base-x package: the attacker model is a compromised or typosquatted npm publisher using a trusted-looking base encoding library to beacon usage to their server. The main entrypoint `src/cjs/index.cjs` injects an `async function msgLog(message)` inside `decode()` that POSTs every decoded string to a hardcoded IP address, and the same C2 URL appears in `src/esm/index.js`. The IOC is explicitly classified as `role: c2`, which is not compatible with a normal encoding library, and the package was published by a brand-new burner-like account with near-duplicate package names (`base65-15x`, `base65-33x`, `base65-77x`, `bs58-15`, etc.). ENTRY src/cjs/index.cjs (main: src/cjs/index.cjs) DESTINATION - 2 c2 (ipv4, urls) (values recorded in verified_iocs) EXFIL - Suspicious Domain in src/cjs/index.cjs: "http://46.250.253.63" - Suspicious Domain in src/esm/index.js: "http://46.250.253.63" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern