GCVE-110-OSM-2026-10390

npm/bs58-77 is a typosquat of the popular bs58 base58 codec (cryptocoinjs). The package contains no malicious code of its own: its src/cjs/index.cjs simply does require("base65-77x") and re-exports it. Its sole purpose is to pull in the malicious sink package base65-77x as a runtime dependency (declared dependency: base65-77x: ^5.0.1). base65-77x is a near-verbatim clone of base-x whose decode() exfiltrates every string passed to it by POSTing the raw input to a hardcoded bare-IP C2 (http://46.250.253.63:3000/api/log) before throwing; because base-x/bs58 are how crypto tooling base58-decodes private keys and seeds, the exfiltrated values are frequently secrets. The sink is reported separately as MAL-2026-13750. bs58-77 and its sibling wrappers (bs58-15, bs58-33) were published alongside the three base65 sinks by a single npm maintainer account (smallmantis) within a ~90-minute window on 2026-08-11, forming a matched six-package delivery-plus-exfiltration campaign. Installing bs58-77 is sufficient to introduce the key-exfiltration behavior into a dependent project. Judge assessment: This is a supply-chain delivery package in a typosquatting campaign: the attacker model is a malicious npm maintainer using a fake bs58 wrapper to pull in a sink dependency that steals decoded secrets. The entrypoint `src/cjs/index.cjs` is a trivial re-export of `base65-77x`, matching the OSV advisory that the package's sole purpose is to introduce the malicious dependency rather than implement base58 itself. The metadata is also highly incriminating: `smallmantis` is a 2-day-old burner account with `publisherMaliciousPackages` including `base65-15x`, `base65-33x`, and `base65-77x`, and the package name `bs58-77` is a near-duplicate of the legitimate `bs58` codec. The recovered IOC `16UjcYNBG9GTK4uq2f7yYEbuifqCzoLMGS` and the advisory's described exfil path to `base65-77x` reinforce that this campaign targets cryptocurrency key/seeds used by crypto tooling. ENTRY src/cjs/index.cjs (main: src/cjs/index.cjs) DESTINATION - 1 exfil (bitcoinAddresses) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern