bs58-33@6.0.1

Analysis

bs58-33@6.0.1 is a trojanized clone of the legitimate bs58 base58-encoding library. The package source is copied verbatim from the real cryptocoinjs/bs58, but its runtime dependency is replaced: instead of the legitimate `base-x` library, it depends on `base65-33x`, a malicious package. The package's only code is `import basex from 'base65-33x'`, so any project that installs bs58-33 pulls in and executes the malicious dependency. The package has no repository of its own and no other functionality beyond forwarding to the substituted dependency.