DependencyWatch.io
Talk to PrecursorScan a lockfile

13 npm packages target Coinbase and Base internal names via dependency confusion

CriticalDependency confusionnpm

On 2026-09-07 GitHub Advisory flagged 13 new npm packages under names that exactly match Coinbase internal namespaces: cb-wallet-* (7 pkgs), base-account-core/base-app-data, scw-mobile/scw-core, wallet-engine-signing, wallet-cds-web. All carry the full-compromise malware boilerplate. Classic dep-confusion probe against Coinbase Wallet, Base L2, and Smart Contract Wallet builds.

Published 7 Sept 2026

Check your package-lock.jsonSource advisory
At a glancenpm-2026-09-07-coinbase-base-cb-wallet-dep-confusion
13
Packages tracked13 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
Critical
Type
Dependency confusion
Published
7 Sept 2026
Ecosystems
npm
Detected by
GitHub Advisory Database
Also known as
2026-09-07 Coinbase Wallet dep-confusion, Coinbase Base Smart Contract Wallet npm impersonator drop, cb-wallet-* dep-confusion cluster

Dependency confusion. A package published on the public registry under a name guessed from a company's private registry, usually at a sentinel version such as 0.0.0 or 99.99.0, so a misconfigured resolver pulls it instead of the internal one. Many are bug-bounty or penetration-test probes whose only payload is a beacon with the hostname.

What happened

The full picture

Between roughly 2026-09-07 00:00 and 2026-09-07 08:00 UTC, GitHub Advisory Database published 13 new malware advisories against npm packages whose names line up one-for-one with Coinbase internal namespaces:

Cluster - Coinbase / Base / Smart Contract Wallet / Wallet-Engine internal-namespace dep-confusion drop

PackageGHSACoinbase surface
cb-wallet-httpGHSA-mv3f-92cr-83h7Coinbase Wallet HTTP client
cb-wallet-storeGHSA-gw4f-3mgw-h64xCoinbase Wallet state store
cb-wallet-dataGHSA-7w56-x3g2-57fgCoinbase Wallet data layer
cb-wallet-envGHSA-m477-pr6m-v2fpCoinbase Wallet environment shim
cb-wallet-metadataGHSA-cxwc-958j-45g8Coinbase Wallet metadata module
cb-wallet-analyticsGHSA-7944-c265-3ff7Coinbase Wallet analytics module
cb-wallet-solana-providerGHSA-5cg4-38v4-j4vcCoinbase Wallet Solana chain provider
base-account-coreGHSA-vgm8-2vf8-769jBase Chain (Coinbase L2) account SDK
base-app-dataGHSA-9hpg-rmwp-vg4pBase Chain app-side data module
scw-mobileGHSA-h9g8-rwcg-hpmhSmart Contract Wallet mobile SDK
scw-coreGHSA-fv48-xvcx-h3qhSmart Contract Wallet core
wallet-engine-signingGHSA-qw4m-ccr9-7r43Coinbase Wallet signing engine
wallet-cds-webGHSA-qh9w-32r6-2qpwCoinbase Data Service web client

One operator publishing 13 packages under names that exactly match Coinbase internal namespaces in one burst is the textbook dep-confusion pattern: Alex Birsan (2021), and every follow-on @apple-internal-*, @google-cloud-internal-*, @microsoft-*, @stripe-*, @paypal-* probe since, work the same way. GHSA metadata is thin - each package carries the full-compromise boilerplate ("any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer") and no source code repository, no CVE, no explicit vendor attribution - but the naming pattern alone is diagnostic.

Why this cluster is different from the general GHSA sweep

The accompanying multi-2026-09-07-ghsa-malware-sweep module covers hundreds of eka-* tea.xyz autopublish spam, eigenstate-* tea.xyz autopublish spam, effective_*_z3n / efficient_*_z3n research pattern spam, and other alphabetical backfill from the Sept 6-7 window - low-signal noise unlikely to hit real lockfiles. This 13-package cluster is completely separate: single-operator, single-day, targeted at one identifiable vendor's (Coinbase) internal namespaces. Any lockfile hit here is high-confidence targeted-attack exposure, not accidental typosquat.

Coinbase surface mapping

  • *`cb- prefix**: Coinbase's public and internal short-form prefix. The Coinbase Wallet SDK, Coinbase Exchange internal tooling, and Coinbase-published bug-bounty responses all use cb-` as the short-form vendor prefix.
  • *`base- prefix**: Base (chain) is Coinbase's Ethereum L2. Base-branded SDKs (@base/, base-) publish libraries for account abstraction (ERC-4337), on-chain identity, and app-side data. base-account-core` in particular reads as an AA-flow SDK internal name.
  • *`scw- prefix**: "Smart Contract Wallet" - the AA-based wallet product Coinbase and other issuers (Argent, Safe, Ambire) build around ERC-4337. scw-mobile / scw-core` is the exact shape of an internal core+mobile-wrapper SDK pair.
  • wallet-engine-signing, wallet-cds-web: wallet-engine is Coinbase's cross-chain signing engine; CDS = Coinbase Data Service. Both are names a Coinbase engineer would type into a package.json without a scope prefix during early prototyping.

Recommended posture

If you work at Coinbase or Base and any internal npm mirror shows a resolution attempt against any of these 13 names, treat the resolving host as fully compromised (per GHSA guidance) and rotate every credential the host had access to. If you build a dApp or integration against Coinbase Wallet / Base / Smart Contract Wallet SDKs and any bare-name pin appears in your lockfile, apply the same triage - the malware's postinstall payload has already run.

Registry state

All 13 packages are flagged as malware in npm's registry and quarantined; GHSA advisories are live. Private mirrors that cached tarballs before quarantine will keep serving them - explicit deny-listing of all 13 names on internal Verdaccio / Artifactory / Nexus is the durable mitigation.

Discovery credits

GitHub Advisory Database (all 13 advisories published 2026-09-07). The absence of a named vendor blog write-up at the time this record was authored is consistent with the age of the campaign (published today); expect Socket / Snyk / JFrog / Aikido / Phylum follow-up in the days after.

dependency-confusiontyposquatcredential-theftcrypto-wallet-drain
Affected packages

13 packages 13 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →
Impact

What it does if you installed it

  • Coinbase-internal build-system compromise if resolved: every one of the 13 packages is named exactly like a package a Coinbase or Base engineer would expect to resolve from their internal npm registry (cb-wallet-http, cb-wallet-store, cb-wallet-data, cb-wallet-env, cb-wallet-metadata, cb-wallet-analytics, cb-wallet-solana-provider, base-account-core, base-app-data, scw-mobile, scw-core, wallet-engine-signing, wallet-cds-web). GHSA classifies each with the full-compromise boilerplate ("any computer that has this package installed or running should be considered fully compromised") - the more serious of the two GHSA malware boilerplate templates, reserved for backdoor / RAT-style code, not the low-signal reconnaissance template
  • Downstream Coinbase Wallet SDK integrators exposed by name shadowing: any third-party dApp or wallet-integration project whose package.json references bare cb-wallet-http / cb-wallet-store / wallet-engine-signing without a scope prefix (@coinbase/cb-wallet-http, etc.) resolves against public npm and picks up the malicious version at npm install time. Reference-scanner hits on any of these bare names in a public lockfile are near-certainly compromised
  • Base Chain L2 developer tooling exposure: base-account-core and base-app-data sit inside the base-* naming pattern that Base (Coinbase's Ethereum L2) uses for its account-abstraction (ERC-4337) SDK. Any AA-flow demo, hackathon project, or SDK sample that pins these bare names is compromised on install
  • *Smart Contract Wallet (`scw-) probes are the WalletConnect-adjacent path**: scw-mobile and scw-core` target the "smart contract wallet" name space Coinbase (and several other issuers - Argent, Safe, Ambire) use for AA-based wallet libraries. A bare-name pin from an AA project resolves to public npm and installs the dropper
  • Post-install execution and CI compromise: consistent with the other September 2026 dep-confusion campaigns (multi-2026-09-03 frank/frengki0707 Apple + Google/GCP wave, multi-2026-09-05 sweep, etc), assume an install-time / postinstall payload that extracts environment variables (AWS_*, GCP_*, NPM_TOKEN, GITHUB_TOKEN), SSH private keys from ~/.ssh/, and ~/.npmrc credentials, then exfils to an attacker-controlled HTTP(S) endpoint. Any host that resolved one of these must be treated as fully compromised until proven otherwise
What to do

Clean-up steps

  1. *For Coinbase / Base / any org with internal `cb- / base- / scw- / wallet-` npm scope*: audit every internal npm resolution log, .npmrc scope pin, and Verdaccio / Artifactory / Nexus mirror config for the exact 13 package names below. Any developer laptop or CI host that resolved one - treat as fully compromised: rotate every credential the host had access to (npm tokens, cloud IAM, git credentials, SSO), reimage, forensicate
  2. Explicit scoped-registry pinning in .npmrc: for @coinbase/, @base/, @scw/, and any other internal Coinbase scope, add explicit registry= lines to .npmrc and enforce them in CI. Never rely on bare unscoped names to resolve to an internal package - dep-confusion works by racing against the internal name over public npm
  3. Downstream dApp / integrator triage: grep every package-lock.json, yarn.lock, pnpm-lock.yaml, and package.json for the 13 bare names below. On any hit, uninstall the package, delete node_modules and the lockfile, rebuild against a clean cache. Rotate any secret the host had access to during the exposure window
  4. Base Chain AA-flow tooling: any hackathon / demo / SDK sample using bare base-account-core or base-app-data should be treated as compromised on install. Explicitly pin the real Coinbase Base SDK packages (@coinbase/base-* where they exist) or vendor the source
  5. Add all 13 names to registry deny-list: private mirrors (Verdaccio, Artifactory, Nexus) that cache public npm should block re-publishes under the same 13 names for at least 30 days after GHSA quarantine, in case the operator rotates and re-uploads
  6. For every npm install in CI, prefer --ignore-scripts to block postinstall payloads. Dep-confusion probes rely on install-time execution; --ignore-scripts neutralises that vector for CI. Complement with npm audit (which surfaces GHSA-flagged malware) and require zero-CVE builds
References

Sources

npm-2026-09-07-coinbase-base-cb-wallet-dep-confusionBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents