DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
CriticalPublished 7 Sept 202613 packages · 13 versions

Coinbase / Base / Smart Contract Wallet internal-namespace dep-confusion drop (13 packages, `cb-wallet-*` + `base-*` + `scw-*` + `wallet-*`)

Summary

On 2026-09-07 GitHub Advisory flagged 13 new npm packages under names that exactly match Coinbase internal namespaces: cb-wallet-* (7 pkgs), base-account-core/base-app-data, scw-mobile/scw-core, wallet-engine-signing, wallet-cds-web. All carry the full-compromise malware boilerplate. Classic dep-confusion probe against Coinbase Wallet, Base L2, and Smart Contract Wallet builds.

dependency-confusiontyposquatcredential-theftcrypto-wallet-drain
Detected by
GitHub Advisory Database
Also known as
2026-09-07 Coinbase Wallet dep-confusion · Coinbase Base Smart Contract Wallet npm impersonator drop · cb-wallet-* dep-confusion cluster
Ecosystems
npm
Packages tracked
13

What happened

Between roughly 2026-09-07 00:00 and 2026-09-07 08:00 UTC, GitHub Advisory Database published 13 new malware advisories against npm packages whose names line up one-for-one with Coinbase internal namespaces:

Cluster - Coinbase / Base / Smart Contract Wallet / Wallet-Engine internal-namespace dep-confusion drop

| Package | GHSA | Coinbase surface | |---|---|---| | cb-wallet-http | GHSA-mv3f-92cr-83h7 | Coinbase Wallet HTTP client | | cb-wallet-store | GHSA-gw4f-3mgw-h64x | Coinbase Wallet state store | | cb-wallet-data | GHSA-7w56-x3g2-57fg | Coinbase Wallet data layer | | cb-wallet-env | GHSA-m477-pr6m-v2fp | Coinbase Wallet environment shim | | cb-wallet-metadata | GHSA-cxwc-958j-45g8 | Coinbase Wallet metadata module | | cb-wallet-analytics | GHSA-7944-c265-3ff7 | Coinbase Wallet analytics module | | cb-wallet-solana-provider | GHSA-5cg4-38v4-j4vc | Coinbase Wallet Solana chain provider | | base-account-core | GHSA-vgm8-2vf8-769j | Base Chain (Coinbase L2) account SDK | | base-app-data | GHSA-9hpg-rmwp-vg4p | Base Chain app-side data module | | scw-mobile | GHSA-h9g8-rwcg-hpmh | Smart Contract Wallet mobile SDK | | scw-core | GHSA-fv48-xvcx-h3qh | Smart Contract Wallet core | | wallet-engine-signing | GHSA-qw4m-ccr9-7r43 | Coinbase Wallet signing engine | | wallet-cds-web | GHSA-qh9w-32r6-2qpw | Coinbase Data Service web client |

One operator publishing 13 packages under names that exactly match Coinbase internal namespaces in one burst is the textbook dep-confusion pattern: Alex Birsan (2021), and every follow-on @apple-internal-*, @google-cloud-internal-*, @microsoft-*, @stripe-*, @paypal-* probe since, work the same way. GHSA metadata is thin - each package carries the full-compromise boilerplate ("any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer") and no source code repository, no CVE, no explicit vendor attribution - but the naming pattern alone is diagnostic.

Why this cluster is different from the general GHSA sweep

The accompanying multi-2026-09-07-ghsa-malware-sweep module covers hundreds of eka-* tea.xyz autopublish spam, eigenstate-* tea.xyz autopublish spam, effective_*_z3n / efficient_*_z3n research pattern spam, and other alphabetical backfill from the Sept 6-7 window - low-signal noise unlikely to hit real lockfiles. This 13-package cluster is completely separate: single-operator, single-day, targeted at one identifiable vendor's (Coinbase) internal namespaces. Any lockfile hit here is high-confidence targeted-attack exposure, not accidental typosquat.

Coinbase surface mapping

  • *`cb- prefix**: Coinbase's public and internal short-form prefix. The Coinbase Wallet SDK, Coinbase Exchange internal tooling, and Coinbase-published bug-bounty responses all use cb-` as the short-form vendor prefix.
  • *`base- prefix**: Base (chain) is Coinbase's Ethereum L2. Base-branded SDKs (@base/, base-) publish libraries for account abstraction (ERC-4337), on-chain identity, and app-side data. base-account-core` in particular reads as an AA-flow SDK internal name.
  • *`scw- prefix**: "Smart Contract Wallet" - the AA-based wallet product Coinbase and other issuers (Argent, Safe, Ambire) build around ERC-4337. scw-mobile / scw-core` is the exact shape of an internal core+mobile-wrapper SDK pair.
  • wallet-engine-signing, wallet-cds-web: wallet-engine is Coinbase's cross-chain signing engine; CDS = Coinbase Data Service. Both are names a Coinbase engineer would type into a package.json without a scope prefix during early prototyping.

Recommended posture

If you work at Coinbase or Base and any internal npm mirror shows a resolution attempt against any of these 13 names, treat the resolving host as fully compromised (per GHSA guidance) and rotate every credential the host had access to. If you build a dApp or integration against Coinbase Wallet / Base / Smart Contract Wallet SDKs and any bare-name pin appears in your lockfile, apply the same triage - the malware's postinstall payload has already run.

Registry state

All 13 packages are flagged as malware in npm's registry and quarantined; GHSA advisories are live. Private mirrors that cached tarballs before quarantine will keep serving them - explicit deny-listing of all 13 names on internal Verdaccio / Artifactory / Nexus is the durable mitigation.

Discovery credits

GitHub Advisory Database (all 13 advisories published 2026-09-07). The absence of a named vendor blog write-up at the time this record was authored is consistent with the age of the campaign (published today); expect Socket / Snyk / JFrog / Aikido / Phylum follow-up in the days after.

Affected packages (13)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.json

Impact

  • Coinbase-internal build-system compromise if resolved: every one of the 13 packages is named exactly like a package a Coinbase or Base engineer would expect to resolve from their internal npm registry (cb-wallet-http, cb-wallet-store, cb-wallet-data, cb-wallet-env, cb-wallet-metadata, cb-wallet-analytics, cb-wallet-solana-provider, base-account-core, base-app-data, scw-mobile, scw-core, wallet-engine-signing, wallet-cds-web). GHSA classifies each with the full-compromise boilerplate ("any computer that has this package installed or running should be considered fully compromised") - the more serious of the two GHSA malware boilerplate templates, reserved for backdoor / RAT-style code, not the low-signal reconnaissance template
  • Downstream Coinbase Wallet SDK integrators exposed by name shadowing: any third-party dApp or wallet-integration project whose package.json references bare cb-wallet-http / cb-wallet-store / wallet-engine-signing without a scope prefix (@coinbase/cb-wallet-http, etc.) resolves against public npm and picks up the malicious version at npm install time. Reference-scanner hits on any of these bare names in a public lockfile are near-certainly compromised
  • Base Chain L2 developer tooling exposure: base-account-core and base-app-data sit inside the base-* naming pattern that Base (Coinbase's Ethereum L2) uses for its account-abstraction (ERC-4337) SDK. Any AA-flow demo, hackathon project, or SDK sample that pins these bare names is compromised on install
  • *Smart Contract Wallet (`scw-) probes are the WalletConnect-adjacent path**: scw-mobile and scw-core` target the "smart contract wallet" name space Coinbase (and several other issuers - Argent, Safe, Ambire) use for AA-based wallet libraries. A bare-name pin from an AA project resolves to public npm and installs the dropper
  • Post-install execution and CI compromise: consistent with the other September 2026 dep-confusion campaigns (multi-2026-09-03 frank/frengki0707 Apple + Google/GCP wave, multi-2026-09-05 sweep, etc), assume an install-time / postinstall payload that extracts environment variables (AWS_*, GCP_*, NPM_TOKEN, GITHUB_TOKEN), SSH private keys from ~/.ssh/, and ~/.npmrc credentials, then exfils to an attacker-controlled HTTP(S) endpoint. Any host that resolved one of these must be treated as fully compromised until proven otherwise

What to do

  1. 1*For Coinbase / Base / any org with internal `cb- / base- / scw- / wallet-` npm scope*: audit every internal npm resolution log, .npmrc scope pin, and Verdaccio / Artifactory / Nexus mirror config for the exact 13 package names below. Any developer laptop or CI host that resolved one - treat as fully compromised: rotate every credential the host had access to (npm tokens, cloud IAM, git credentials, SSO), reimage, forensicate
  2. 2Explicit scoped-registry pinning in .npmrc: for @coinbase/, @base/, @scw/, and any other internal Coinbase scope, add explicit registry= lines to .npmrc and enforce them in CI. Never rely on bare unscoped names to resolve to an internal package - dep-confusion works by racing against the internal name over public npm
  3. 3Downstream dApp / integrator triage: grep every package-lock.json, yarn.lock, pnpm-lock.yaml, and package.json for the 13 bare names below. On any hit, uninstall the package, delete node_modules and the lockfile, rebuild against a clean cache. Rotate any secret the host had access to during the exposure window
  4. 4Base Chain AA-flow tooling: any hackathon / demo / SDK sample using bare base-account-core or base-app-data should be treated as compromised on install. Explicitly pin the real Coinbase Base SDK packages (@coinbase/base-* where they exist) or vendor the source
  5. 5Add all 13 names to registry deny-list: private mirrors (Verdaccio, Artifactory, Nexus) that cache public npm should block re-publishes under the same 13 names for at least 30 days after GHSA quarantine, in case the operator rotates and re-uploads
  6. 6For every npm install in CI, prefer --ignore-scripts to block postinstall payloads. Dep-confusion probes rely on install-time execution; --ignore-scripts neutralises that vector for CI. Complement with npm audit (which surfaces GHSA-flagged malware) and require zero-CVE builds

References

Back to feedSubmit a correction
npm-2026-09-07-coinbase-base-cb-wallet-dep-confusion