base65-* npm malware campaign — base65-33x, base65-15x, base65-77x flagged as embedded malicious code; full host compromise
Severity: critical · Patch status: no-fix-needed · Since 2026-11-12
On 2026-11-12 GitHub published malware advisories for three related npm packages — base65-33x (GHSA-h288-cf23-hrcc), base65-15x (GHSA-v5ww-6933-6prc) and base65-77x (GHSA-v8w4-68hj-hmqq) — all at version 5.0.2, classified as CWE-506 embedded malicious code with no patched versions. The advisories state any computer with these packages installed or running should be considered fully compromised, with attacker control of the machine and no guarantee removal restores a clean state. The near-identical names, versions and publication dates indicate a coordinated typosquat-style malicious package campaign. Downloads are low (~93-97/month), limiting reach, but any installation grants full host compromise. No fix exists; remediation is removal plus credential rotation.
What to do
- Immediately remove base65-33x, base65-15x and base65-77x from all systems and CI/CD environments
- Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer
- Rebuild/reimage affected machines; do not assume removal of the package removes all malicious software
- Audit dependency trees and lockfiles for these or similarly named packages and block them in registries/proxies
- Review logs and network traffic for signs of exfiltration or attacker access since installation
Sources
All live incidents on Threat Watch
