GCVE-110-OSM-2026-10245

The package is published by 'minimantis', a burner account (< 1 day old, 6 packages) with a 60% malicious ratio across already-reported packages (base65-11x, base65-13x, bs58-11). This is a supply-chain attack masquerading as a base encoding utility, consistent with the attacker model seen in sibling packages already confirmed malicious The entrypoint file (src/cjs/index.cjs) contains a heavily obfuscated payload injected inside what appears to be a legitimate base-x library; the deobfuscated base64 blob decodes to reveal a hardcoded C2 exfiltration URL, hardcoded IP address with fetch POST logic, env/credential harvesting, and error suppression — a classic data exfil pattern. The indirect Function constructor access via bracket notation, string-array obfuscation with 112 matches, and 1166 hex escapes across both CJS and ESM entry points confirm deliberate obfuscation of malicious logic. ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern