cb-wallet-http (npm) · Malicious Code
Affects cb-wallet-httpSource GCVE Database
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmcb-wallet-http | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'cb-wallet-http' mimics Coinbase's internal namespace to exploit dependency confusion. Upon installation and usage, it sends identifying information about the package and Node.js runtime to a third-party Cloudflare Workers domain controlled by an unrelated individual. The package is described by its author as a placeholder for security research, but its behavior leaks build environment details without consent. According to a malware advisory, any system with this package installed should be considered fully compromised, requiring immediate secret and key rotation and package removal.