The 'cb-wallet-data' npm package version 0.0.1 is a malicious package impersonating an internal Coinbase namespace. It contains code in postinstall.js and index.js that unconditionally sends an HTTPS GET request to a Cloudflare Workers endpoint controlled by an attacker. This request includes the package name and the Node.js runtime version as query parameters, leaking internal namespace usage and toolchain metadata. While the data exfiltrated is limited, this behavior constitutes supply chain reconnaissance and can lead to full system compromise. According to the GHSA advisory, any system with this package installed or running should be considered fully compromised, requiring immediate secret and key rotation and package removal.

Systems that install or run the 'cb-wallet-data' package version 0.0.1 may have silently transmitted internal namespace and Node.js runtime metadata to attacker-controlled infrastructure. This exposure can aid attackers in supply chain reconnaissance. Furthermore, the advisory states that any computer with this package should be considered fully compromised, implying potential unauthorized control and risk to all stored secrets and keys. The package's presence indicates a severe supply chain security breach.

Remove the 'cb-wallet-data' package version 0.0.1 immediately from all affected systems. Rotate all secrets and keys stored on compromised computers from a separate, clean environment. Because full system compromise is possible, assume that removing the package alone may not eliminate all malicious software. Monitor for any suspicious activity and consider rebuilding affected systems if necessary. No official patch is available; remediation relies on removal and secret rotation.