Malicious Code Detected in bs58chek: A Critical Security Alert
Summary
MAL-2025-16223: Malicious code in bs58chek (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bs58chek package is a widely used library in the npm ecosystem that provides functionality for encoding and decoding Base58Check strings. It is often utilized in applications dealing with cryptocurrencies and blockchain technologies due to its efficiency and ease of use. However, recent findings have revealed that this package contains malicious code, posing significant security risks to applications that rely on it.
Vulnerability Detail
The vulnerability in the bs58chek package stems from the inclusion of malicious code that can compromise the security of applications using this library. This code may lead to unauthorized access, data breaches, or other harmful actions within the affected systems. The malicious code was introduced in version 0 and has not been addressed in subsequent releases, making it imperative for users to take immediate action to mitigate potential risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall bs58chekIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the bs58chek package from their project and replace it with an alternative library that offers similar functionality without the associated risks. This can be done by executing the following command: npm uninstall bs58chek.
Conclusion
The discovery of malicious code in the bs58chek package poses a significant threat to applications that utilize this library. It is crucial for developers to take immediate action by updating or removing the package to safeguard their applications from potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for bs58chek →
FAQ
The bs58chek package is used for encoding and decoding Base58Check strings, commonly utilized in cryptocurrency and blockchain applications.
You can check if your application is affected by this vulnerability using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without any signup.
Using the compromised bs58chek package can lead to unauthorized access, data breaches, and potential exploitation of your application, putting sensitive information at risk.
As of now, there is no specific patched version available for the bs58chek package. Users are advised to remove the package or switch to a safer alternative.
If you cannot update or remove the bs58chek package, consider implementing additional security measures, such as monitoring for unusual activity and conducting regular security audits.
Related vulnerabilities
Recent vulnerabilities recorded for bs58chek.
