MalwarePublished 20 May 2026Updated 8 Sep 2026

cb-wallet-data (npm) · Malicious Code

Affects cb-wallet-dataSource GCVE Database

What to do

Affected software

Product	Affected	Fixed in
npmcb-wallet-data	Affected =0.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The 'cb-wallet-data' npm package, published by an unaffiliated party but targeting a presumed Coinbase internal namespace, contains malicious code that sends an HTTPS GET request to an attacker-controlled endpoint during installation and import. This request transmits the package name and Node.js runtime version, exposing sensitive supply-chain reconnaissance data. The package version 0.0.1 is affected. Although the payload does not scrape credentials or environment variables, the presence of this beacon indicates a supply chain compromise risk. Removal of the package is recommended, but full system compromise is possible, necessitating secret and key rotation from a clean system.

Impact

Systems that install or run the 'cb-wallet-data' package version 0.0.1 may have silently transmitted internal namespace and Node.js runtime metadata to attacker-controlled infrastructure. This exposure can aid attackers in supply chain reconnaissance. Furthermore, the advisory states that any computer with this package should be considered fully compromised, implying potential unauthorized control and risk to all stored secrets and keys. The package's presence indicates a severe supply chain security breach.

Defensive guidance

Remove the 'cb-wallet-data' package version 0.0.1 immediately from all affected systems. Rotate all secrets and keys stored on compromised computers from a separate, clean environment. Because full system compromise is possible, assume that removing the package alone may not eliminate all malicious software. Monitor for any suspicious activity and consider rebuilding affected systems if necessary.

Summary

The 'cb-wallet-data' npm package version 0.0.1 is a malicious package impersonating an internal Coinbase namespace. It contains code in postinstall.js and index.js that unconditionally sends an HTTPS GET request to a Cloudflare Workers endpoint controlled by an attacker. This request includes the package name and the Node.js runtime version as query parameters, leaking internal namespace usage and toolchain metadata. While the data exfiltrated is limited, this behavior constitutes supply chain reconnaissance and can lead to full system compromise. According to the GHSA advisory, any system with this package installed or running should be considered fully compromised, requiring immediate secret and key rotation and package removal.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Sep 2026, 05:23 UTC

Technical details

References

Community reviews