Base58
1 incident, 0 live. 210 days since the last new one.
1 drains in the last 12 months
1 drains in the last 12 months
1 drains in 2026
Past
March 2026 1
-
Medium◐Partly contained
Five typosquatted npm packages hook Base58 decoding to steal Solana and Ethereum private keys
In March 2026, Cyber Press reported five malicious npm packages from the account 'galedonovan', aimed at crypto developers: raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet and base_xd. The Solana packages intercept Base58 decode() calls used to load keypairs and send the private key in plain text to a Telegram bot, while the app keeps working normally. The Ethereum package hooks the Wallet constructor. base_xd was pulled within five minutes, but the other four were still live when the report came out. Developers who installed any of them should rotate keys and move funds.
npm packages raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet, base_xd·Solana, Ethereum·Since Mar 26, 2026·
No drains match these filters.