The npm package 'cb-wallet-http' mimics Coinbase's internal namespace to exploit dependency confusion. Upon installation and usage, it sends identifying information about the package and Node.js runtime to a third-party Cloudflare Workers domain controlled by an unrelated individual. The package is described by its author as a placeholder for security research, but its behavior leaks build environment details without consent. According to a malware advisory, any system with this package installed should be considered fully compromised, requiring immediate secret and key rotation and package removal.