MAL-2026-4506

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cb-wallet-data/MAL-2026-4506.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-4506

Published

2026-05-20T02:34:35Z

Modified

2026-05-26T06:02:16.942131847Z

Summary

Malicious code in cb-wallet-data (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9d076ee3d487c7c10f785494c4391e39eb327b696224d5653746144fa5ac8d37)

Package name 'cb-wallet-data' targets a presumed Coinbase-internal namespace and is published by an unaffiliated party. Both postinstall.js (npm install lifecycle hook) and index.js (main, runs on require) issue an unconditional HTTPS GET to https://icy-cell-fb53.gh0stfqce25.workers.dev/poc carrying the package name and installer Node.js runtime version as query parameters. Any developer or build system whose package manager misroutes the internal name 'cb-wallet-data' to the public npm registry will silently transmit the existence of that internal name plus their Node version to a third-party Cloudflare Workers endpoint without consent. While the payload is narrow (no credential or environment scraping), the channel is a confirmed install-time and import-time beacon to attacker/researcher-controlled infrastructure, exposing internal namespace and toolchain metadata that itself is sensitive supply-chain reconnaissance data.

Database specific

{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-003425",
            "sha256": "9d076ee3d487c7c10f785494c4391e39eb327b696224d5653746144fa5ac8d37",
            "import_time": "2026-05-26T05:50:37.125659606Z",
            "modified_time": "2026-05-20T02:34:35Z",
            "source": "amazon-inspector",
            "versions": [
                "0.0.1"
            ]
        }
    ]
}

References

https://www.npmjs.com/package/cb-wallet-data/v/0.0.1

Credits

- Amazon Inspector - FINDER
- - actran@amazon.com

Affected packages

npm / cb-wallet-data

Package

Name: cb-wallet-data; View open source insights on deps.dev
Purl: pkg:npm/cb-wallet-data

Affected ranges

Affected versions

0.*

0.0.1

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]

indicators

{
    "package_integrity": [
        {
            "filename": "cb-wallet-data-0.0.1.tgz",
            "hashes": {
                "sha1": "f252b3be294971acff897ff343134fafca31290e",
                "sha512_sri": "sha512-PSyli4QysPr+xkaCe/04KZyjUTGkvgWOyWjRfPP9GfIDObDfIF8CG/5eCpC7H52MoUqfzhHmTcgFifI3r1JQ8g=="
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "73e0a3f421e8722c2cf83ac82117991fd287813074d9d9c09bd010a11bc65a55563195",
            "sha256": "435917089164733773227c8876a1606d3798a75e6d22f97449272ce9cc47284b",
            "path": "postinstall.js"
        },
        {
            "tlsh": "b9f055a06864da3b28f857a909b7f40c6d22890b5148bc1f1bff004c935d6fa45bf69f",
            "sha256": "dd65a7145e4e887d627f0fd18f76aa65d5763d47cc4eca07387c083d0cd75991",
            "path": "package.json"
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cb-wallet-data/MAL-2026-4506.json"