# 13 npm packages target Coinbase and Base internal names via dependency confusion

> On 2026-09-07 GitHub Advisory flagged 13 new npm packages under names that exactly match Coinbase internal namespaces: `cb-wallet-*` (7 pkgs), `base-account-core`/`base-app-data`, `scw-mobile`/`scw-core`, `wallet-engine-signing`, `wallet-cds-web`. All carry the full-compromise malware boilerplate. Classic dep-confusion probe against Coinbase Wallet, Base L2, and Smart Contract Wallet builds.

- Published: 2026-09-07
- Severity: critical
- Kind: Dependency confusion - A package published on the public registry under a name guessed from a company's private registry, usually at a sentinel version such as 0.0.0 or 99.99.0, so a misconfigured resolver pulls it instead of the internal one. Many are bug-bounty or penetration-test probes whose only payload is a beacon with the hostname.
- Ecosystems: npm
- Scope: 13 packages, 13 compromised versions
- Tags: dependency-confusion, typosquat, credential-theft, crypto-wallet-drain
- Also known as: 2026-09-07 Coinbase Wallet dep-confusion, Coinbase Base Smart Contract Wallet npm impersonator drop, cb-wallet-* dep-confusion cluster
- Detected by: GitHub Advisory Database
- Incident ID: npm-2026-09-07-coinbase-base-cb-wallet-dep-confusion

## Affected packages (13)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [base-account-core](https://dependencywatch.io/package/npm/base-account-core) | npm | 0.0.0 |
| [base-app-data](https://dependencywatch.io/package/npm/base-app-data) | npm | 0.0.0 |
| [cb-wallet-analytics](https://dependencywatch.io/package/npm/cb-wallet-analytics) | npm | 0.0.0 |
| [cb-wallet-data](https://dependencywatch.io/package/npm/cb-wallet-data) | npm | 0.0.0 |
| [cb-wallet-env](https://dependencywatch.io/package/npm/cb-wallet-env) | npm | 0.0.0 |
| [cb-wallet-http](https://dependencywatch.io/package/npm/cb-wallet-http) | npm | 0.0.0 |
| [cb-wallet-metadata](https://dependencywatch.io/package/npm/cb-wallet-metadata) | npm | 0.0.0 |
| [cb-wallet-solana-provider](https://dependencywatch.io/package/npm/cb-wallet-solana-provider) | npm | 0.0.0 |
| [cb-wallet-store](https://dependencywatch.io/package/npm/cb-wallet-store) | npm | 0.0.0 |
| [scw-core](https://dependencywatch.io/package/npm/scw-core) | npm | 0.0.0 |
| [scw-mobile](https://dependencywatch.io/package/npm/scw-mobile) | npm | 0.0.0 |
| [wallet-cds-web](https://dependencywatch.io/package/npm/wallet-cds-web) | npm | 0.0.0 |
| [wallet-engine-signing](https://dependencywatch.io/package/npm/wallet-engine-signing) | npm | 0.0.0 |

## What happened

Between roughly 2026-09-07 00:00 and 2026-09-07 08:00 UTC, GitHub Advisory Database published 13 new malware advisories against npm packages whose names line up one-for-one with Coinbase internal namespaces:

## Cluster - Coinbase / Base / Smart Contract Wallet / Wallet-Engine internal-namespace dep-confusion drop

| Package | GHSA | Coinbase surface |
|---|---|---|
| `cb-wallet-http` | GHSA-mv3f-92cr-83h7 | Coinbase Wallet HTTP client |
| `cb-wallet-store` | GHSA-gw4f-3mgw-h64x | Coinbase Wallet state store |
| `cb-wallet-data` | GHSA-7w56-x3g2-57fg | Coinbase Wallet data layer |
| `cb-wallet-env` | GHSA-m477-pr6m-v2fp | Coinbase Wallet environment shim |
| `cb-wallet-metadata` | GHSA-cxwc-958j-45g8 | Coinbase Wallet metadata module |
| `cb-wallet-analytics` | GHSA-7944-c265-3ff7 | Coinbase Wallet analytics module |
| `cb-wallet-solana-provider` | GHSA-5cg4-38v4-j4vc | Coinbase Wallet Solana chain provider |
| `base-account-core` | GHSA-vgm8-2vf8-769j | Base Chain (Coinbase L2) account SDK |
| `base-app-data` | GHSA-9hpg-rmwp-vg4p | Base Chain app-side data module |
| `scw-mobile` | GHSA-h9g8-rwcg-hpmh | Smart Contract Wallet mobile SDK |
| `scw-core` | GHSA-fv48-xvcx-h3qh | Smart Contract Wallet core |
| `wallet-engine-signing` | GHSA-qw4m-ccr9-7r43 | Coinbase Wallet signing engine |
| `wallet-cds-web` | GHSA-qh9w-32r6-2qpw | Coinbase Data Service web client |

One operator publishing 13 packages under names that exactly match Coinbase internal namespaces in one burst is the textbook dep-confusion pattern: Alex Birsan (2021), and every follow-on `@apple-internal-*`, `@google-cloud-internal-*`, `@microsoft-*`, `@stripe-*`, `@paypal-*` probe since, work the same way. GHSA metadata is thin - each package carries the full-compromise boilerplate ("any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer") and no source code repository, no CVE, no explicit vendor attribution - but the naming pattern alone is diagnostic.

## Why this cluster is different from the general GHSA sweep

The accompanying `multi-2026-09-07-ghsa-malware-sweep` module covers hundreds of `eka-*` tea.xyz autopublish spam, `eigenstate-*` tea.xyz autopublish spam, `effective_*_z3n` / `efficient_*_z3n` research pattern spam, and other alphabetical backfill from the Sept 6-7 window - low-signal noise unlikely to hit real lockfiles. This 13-package cluster is completely separate: single-operator, single-day, targeted at one identifiable vendor's (Coinbase) internal namespaces. Any lockfile hit here is high-confidence targeted-attack exposure, not accidental typosquat.

## Coinbase surface mapping

- **`cb-*` prefix**: Coinbase's public and internal short-form prefix. The Coinbase Wallet SDK, Coinbase Exchange internal tooling, and Coinbase-published bug-bounty responses all use `cb-` as the short-form vendor prefix.
- **`base-*` prefix**: Base (chain) is Coinbase's Ethereum L2. Base-branded SDKs (`@base/*`, `base-*`) publish libraries for account abstraction (ERC-4337), on-chain identity, and app-side data. `base-account-core` in particular reads as an AA-flow SDK internal name.
- **`scw-*` prefix**: "Smart Contract Wallet" - the AA-based wallet product Coinbase and other issuers (Argent, Safe, Ambire) build around ERC-4337. `scw-mobile` / `scw-core` is the exact shape of an internal core+mobile-wrapper SDK pair.
- **`wallet-engine-signing`, `wallet-cds-web`**: `wallet-engine` is Coinbase's cross-chain signing engine; `CDS` = Coinbase Data Service. Both are names a Coinbase engineer would type into a `package.json` without a scope prefix during early prototyping.

## Recommended posture

If you work at Coinbase or Base and any internal npm mirror shows a resolution attempt against any of these 13 names, treat the resolving host as fully compromised (per GHSA guidance) and rotate every credential the host had access to. If you build a dApp or integration against Coinbase Wallet / Base / Smart Contract Wallet SDKs and any bare-name pin appears in your lockfile, apply the same triage - the malware's postinstall payload has already run.

## Registry state

All 13 packages are flagged as malware in npm's registry and quarantined; GHSA advisories are live. Private mirrors that cached tarballs before quarantine will keep serving them - explicit deny-listing of all 13 names on internal Verdaccio / Artifactory / Nexus is the durable mitigation.

## Discovery credits

`GitHub Advisory Database` (all 13 advisories published 2026-09-07). The absence of a named vendor blog write-up at the time this record was authored is consistent with the age of the campaign (published today); expect Socket / Snyk / JFrog / Aikido / Phylum follow-up in the days after.

## Impact

- **Coinbase-internal build-system compromise if resolved**: every one of the 13 packages is named exactly like a package a Coinbase or Base engineer would expect to resolve from their internal npm registry (`cb-wallet-http`, `cb-wallet-store`, `cb-wallet-data`, `cb-wallet-env`, `cb-wallet-metadata`, `cb-wallet-analytics`, `cb-wallet-solana-provider`, `base-account-core`, `base-app-data`, `scw-mobile`, `scw-core`, `wallet-engine-signing`, `wallet-cds-web`). GHSA classifies each with the full-compromise boilerplate ("any computer that has this package installed or running should be considered fully compromised") - the more serious of the two GHSA malware boilerplate templates, reserved for backdoor / RAT-style code, not the low-signal reconnaissance template
- **Downstream Coinbase Wallet SDK integrators exposed by name shadowing**: any third-party dApp or wallet-integration project whose `package.json` references bare `cb-wallet-http` / `cb-wallet-store` / `wallet-engine-signing` without a scope prefix (`@coinbase/cb-wallet-http`, etc.) resolves against public npm and picks up the malicious version at `npm install` time. Reference-scanner hits on any of these bare names in a public lockfile are near-certainly compromised
- **Base Chain L2 developer tooling exposure**: `base-account-core` and `base-app-data` sit inside the `base-*` naming pattern that Base (Coinbase's Ethereum L2) uses for its account-abstraction (ERC-4337) SDK. Any AA-flow demo, hackathon project, or SDK sample that pins these bare names is compromised on install
- **Smart Contract Wallet (`scw-*`) probes are the WalletConnect-adjacent path**: `scw-mobile` and `scw-core` target the "smart contract wallet" name space Coinbase (and several other issuers - Argent, Safe, Ambire) use for AA-based wallet libraries. A bare-name pin from an AA project resolves to public npm and installs the dropper
- **Post-install execution and CI compromise**: consistent with the other September 2026 dep-confusion campaigns (`multi-2026-09-03` `frank`/`frengki0707` Apple + Google/GCP wave, `multi-2026-09-05` sweep, etc), assume an install-time / postinstall payload that extracts environment variables (`AWS_*`, `GCP_*`, `NPM_TOKEN`, `GITHUB_TOKEN`), SSH private keys from `~/.ssh/`, and `~/.npmrc` credentials, then exfils to an attacker-controlled HTTP(S) endpoint. Any host that resolved one of these must be treated as fully compromised until proven otherwise

## What to do

1. **For Coinbase / Base / any org with internal `cb-*` / `base-*` / `scw-*` / `wallet-*` npm scope**: audit every internal npm resolution log, `.npmrc` scope pin, and Verdaccio / Artifactory / Nexus mirror config for the exact 13 package names below. Any developer laptop or CI host that resolved one - treat as fully compromised: rotate every credential the host had access to (npm tokens, cloud IAM, git credentials, SSO), reimage, forensicate
2. **Explicit scoped-registry pinning in `.npmrc`**: for `@coinbase/`, `@base/`, `@scw/`, and any other internal Coinbase scope, add explicit `registry=` lines to `.npmrc` and enforce them in CI. Never rely on bare unscoped names to resolve to an internal package - dep-confusion works by racing against the internal name over public npm
3. **Downstream dApp / integrator triage**: grep every `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, and `package.json` for the 13 bare names below. On any hit, uninstall the package, delete `node_modules` and the lockfile, rebuild against a clean cache. Rotate any secret the host had access to during the exposure window
4. **Base Chain AA-flow tooling**: any hackathon / demo / SDK sample using bare `base-account-core` or `base-app-data` should be treated as compromised on install. Explicitly pin the real Coinbase Base SDK packages (`@coinbase/base-*` where they exist) or vendor the source
5. **Add all 13 names to registry deny-list**: private mirrors (Verdaccio, Artifactory, Nexus) that cache public npm should block re-publishes under the same 13 names for at least 30 days after GHSA quarantine, in case the operator rotates and re-uploads
6. For every `npm install` in CI, prefer `--ignore-scripts` to block postinstall payloads. Dep-confusion probes rely on install-time execution; `--ignore-scripts` neutralises that vector for CI. Complement with `npm audit` (which surfaces GHSA-flagged malware) and require zero-CVE builds

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories (query used to enumerate this cluster)](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-mv3f-92cr-83h7 - cb-wallet-http](https://github.com/advisories/GHSA-mv3f-92cr-83h7) - GitHub
- [GHSA-gw4f-3mgw-h64x - cb-wallet-store](https://github.com/advisories/GHSA-gw4f-3mgw-h64x) - GitHub
- [GHSA-7w56-x3g2-57fg - cb-wallet-data](https://github.com/advisories/GHSA-7w56-x3g2-57fg) - GitHub
- [GHSA-m477-pr6m-v2fp - cb-wallet-env](https://github.com/advisories/GHSA-m477-pr6m-v2fp) - GitHub
- [GHSA-cxwc-958j-45g8 - cb-wallet-metadata](https://github.com/advisories/GHSA-cxwc-958j-45g8) - GitHub
- [GHSA-7944-c265-3ff7 - cb-wallet-analytics](https://github.com/advisories/GHSA-7944-c265-3ff7) - GitHub
- [GHSA-5cg4-38v4-j4vc - cb-wallet-solana-provider](https://github.com/advisories/GHSA-5cg4-38v4-j4vc) - GitHub
- [GHSA-vgm8-2vf8-769j - base-account-core](https://github.com/advisories/GHSA-vgm8-2vf8-769j) - GitHub
- [GHSA-9hpg-rmwp-vg4p - base-app-data](https://github.com/advisories/GHSA-9hpg-rmwp-vg4p) - GitHub
- [GHSA-h9g8-rwcg-hpmh - scw-mobile](https://github.com/advisories/GHSA-h9g8-rwcg-hpmh) - GitHub
- [GHSA-fv48-xvcx-h3qh - scw-core](https://github.com/advisories/GHSA-fv48-xvcx-h3qh) - GitHub
- [GHSA-qw4m-ccr9-7r43 - wallet-engine-signing](https://github.com/advisories/GHSA-qw4m-ccr9-7r43) - GitHub
- [GHSA-qh9w-32r6-2qpw - wallet-cds-web](https://github.com/advisories/GHSA-qh9w-32r6-2qpw) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-09-07-coinbase-base-cb-wallet-dep-confusion
Markdown version: https://dependencywatch.io/incident/npm-2026-09-07-coinbase-base-cb-wallet-dep-confusion.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).