Which versions of @tabrex/bs58 are malicious?

The following npm versions of @tabrex/bs58 are flagged malicious: 6.0.3. Treat any of these as compromised.

How do I remediate @tabrex/bs58 if I installed it?

@tabrex/bs58 is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed @tabrex/bs58 — how do I know if it already compromised me?

If @tabrex/bs58 was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is @tabrex/bs58 part of a known attack campaign?

Yes — @tabrex/bs58 is associated with the IN-MAL-2026-010367 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find @tabrex/bs58 across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @tabrex/bs58 (version 6.0.3). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @tabrex/bs58 across your stack and pipelines.

Malicious package

@tabrex/bs58npm

Malicious code in @tabrex/bs58 (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-10523

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @tabrex/bs58

What this malware does

@tabrex/bs58 ships the verbatim README, API surface, and repository URL of the legitimate cryptocoinjs/bs58 package (package.json declares repository https://github.com/cryptocoinjs/bs58 and the README contains 'npm i --save bs58' instructions for that real package), but the bundled entrypoints src/cjs/index.cjs and src/esm/index.js have a heavily obfuscated payload appended after the base58 implementation. The payload uses an Obfuscator.io-style rotated string array decoded via RC4 (function a5() with a base64 alphabet decoder feeding a4()), control-flow flattening with a while(!![]) switch dispatcher, and a self-defending anti-debug check. At require()/import time the payload re-spawns the host Node process detached with a sentinel env var (spawn(process.argv[0],..., {detached:true, stdio:'ignore', windowsHide:true, env:w, cwd:y})), downloads an encrypted binary over HTTPS to a destination hidden inside the obfuscated string array, verifies its SHA256 against a sidecar.metadata.json, AES-256-GCM-decrypts it with a key derived from XORing four base64 fragments, then chmods and executes the decrypted binary. Any project that installs and loads @tabrex/bs58 (directly or transitively) executes attacker-controlled code on the developer/build machine on first require. Combination of typosquat lure of a top-tier crypto package, README/repo impersonation, heavy obfuscation, and remote-fetch-decrypt-exec at module-load time is unambiguous supply-chain attack.

Malicious versions

1 flagged

6.0.3

Indicators of compromise (SHA-256)

4f8a6402182b6dec89b04f15d70fcdd2b78d678947d49c62a3f09b11a70bf306

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @tabrex/bs58 (version 6.0.3). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @tabrex/bs58 across your stack and pipelines.
If you installed it — respond
@tabrex/bs58 is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If @tabrex/bs58 was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @tabrex/bs58 before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. @tabrex/bs58 on npm has been identified as a malicious package (version 6.0.3 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-010367

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks @tabrex/bs58-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring