GCVE-110-OSM-2026-10237

This package is a malicious supply-chain attack that proxies through a known-malicious dependency. The entrypoint `src/cjs/index.cjs` directly requires `base65-11x`, which is flagged as confirmed malicious. The publisher 'minimantis' created a burner account that published all 6 packages (bs58-11, bs58-12, bs58-13, base65-11x, base65-12x, base65-13x) within minutes of account creation, forming a coordinated typosquatting/dependency confusion cluster targeting the popular `bs58` library. A Bitcoin address (`16UjcYNBG9GTK4uq2f7yYEbuifqCzoLMGS`) classified as an exfil IOC is present in the package, consistent with crypto-theft malware. The security holding flag was set and recovered, confirming this package has already been identified as harmful. ENTRY src/cjs/index.cjs (main: src/cjs/index.cjs) DESTINATION - 1 exfil (bitcoinAddresses) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Malicious Dependency Detected in package.json - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern