base65-85x@5.0.1

Analysis

base65-85x is a combosquat of the legitimate base-x encoding library. The decode() function has been injected with a javascript-obfuscator bytecode virtual machine that, when called, constructs and sends a POST request to hxxp://168[.]231[.]81[.]80:3001/api/log with a JSON body. The C2 endpoint receives data from the compromised environment. The package impersonates the real base-x author (Daniel Cousens) in its metadata but is published by a different account.