GCVE-110-OSM-2026-10679

base99-85x is a typosquat of the base-x encoding library. Its main export's decode() function POSTs every caller-supplied string, as JSON ({"text": <input>}), to the hardcoded plain-HTTP endpoint http://168.231.81.80:3001/api/log before returning the decoded buffer. Both the CommonJS and ESM build outputs contain the same relay via an inline msgLog helper, so the exfiltration fires regardless of whether consumers load the package via require or import. Callers of base-x commonly pass base58/base64-encoded secret material such as private keys, wallet seeds, and cryptographic payloads; any such input decoded through this package is transmitted to the operator of 168.231.81.80 in cleartext without disclosure or consent. Judge assessment: This package is a clear credential/data-stealing typosquat of the legitimate base-x library: the main export's decode() path in both CJS and ESM sends caller input to a hardcoded attacker-controlled endpoint before doing the decode. The attacker model is straightforward: a library consumer passes encoded secrets, wallet seeds, or other sensitive payloads into decode(), and those strings are relayed in cleartext to http://168.231.81.80:3001/api/log. The evidence is visible directly in src/cjs/index.cjs and src/esm/index.js via the inline msgLog helper and the plaintext C2 IOC 168.231.81.80. The OSV advisory is corroborated by the code, not needed for the conclusion, and the minimal metadata/typosquat shape reinforces the malicious intent. ENTRY src/cjs/index.cjs (main: src/cjs/index.cjs) DESTINATION - 2 c2 (ipv4, urls) (values recorded in verified_iocs) EXFIL - Suspicious Domain in src/cjs/index.cjs: "http://168.231.81.80" - Suspicious Domain in src/esm/index.js: "http://168.231.81.80"