Introduction Greetings from the island nation of Japan. Six months ago I wrote about befriending Base64, a piece I now read back with the soft embarrassment of glancing at one's own graduation photo. The protagonist has not changed; the setting has. Lately, I keep running into Base64 in places no respectable friend should be (the digital equivalent of spotting an old classmate, slightly out of focus, in the background of an organised crime documentary). They are still doing their decades-old job of turning binary into text, faithfully and without complaint. The crowd they keep, however, is another story. This article is the dark sequel to that friendship piece, charting the supply chain attacks, MCP exploits, and prompt-injection capers in which our friend has been quietly co-starring. By the end, you will see why "obfuscated, but compliant" is the modern attacker's favourite outfit, and what we as developers can do to keep our friend out of the worst neighbourhoods.…