The 'cb-wallet-http' npm package impersonates Coinbase's internal 'cb-wallet-*' namespace to capture dependency confusion resolutions. During 'npm install' and when required in code, it performs an HTTPS GET request to a hardcoded third-party endpoint, transmitting the package name and Node.js runtime version. The endpoint is hosted on a Cloudflare Workers domain registered under a personal handle unrelated to Coinbase. Although the package's description claims it is a reserved placeholder for coordinated security research, its operation leaks host and build topology identifiers without user consent. A malware advisory states that any computer with this package installed should be considered fully compromised, recommending immediate rotation of all secrets and keys from a different machine and removal of the package, though removal may not guarantee full remediation.

Systems that have installed or are running the 'cb-wallet-http' package are considered fully compromised. The package leaks sensitive build and runtime environment information to an attacker-controlled endpoint. This exposure can lead to fingerprinting of vulnerable builds and potentially further compromise. The malware advisory warns that secrets and keys stored on affected systems should be rotated immediately from a separate, uncompromised machine. Removal of the package alone may not eliminate all malicious software introduced by the package.

Remove the 'cb-wallet-http' package immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a different, secure computer. Due to the potential full compromise of affected systems, consider rebuilding or thoroughly auditing the environment to ensure no residual malicious software remains. Monitor dependency resolution configurations to prevent dependency confusion attacks by ensuring that internal namespaces are not resolved to untrusted public packages.