npm: 13 Malicious 'wallet' and 'base-account' Themed Packages Drop in Under a Minute

Key findings

• 13 npm packages disclosed in under a minute on September 7, 2026.
• Many packages impersonate 'wallet' or 'base-account' related functionalities.
• All packages were published just hours before their disclosure.
• All advisories indicate Critical severity, implying severe system compromise.
• Packages include cb-wallet-solana-provider, base-account-core, and scw-mobile.

On September 7, 2026, thirteen malicious packages were disclosed on the npm registry within a single minute, indicating a highly coordinated attack. All of these packages, many designed to impersonate components of a cryptocurrency wallet or financial service, were first published just six hours before their disclosure and subsequent removal.

The packages exhibit a clear thematic pattern, with many names suggesting components of a 'wallet' or 'base account' system. Examples include cb-wallet-solana-provider, base-account-core, cb-wallet-data, scw-mobile, and wallet-engine-signing. This naming strategy strongly suggests an attempt to typosquat or impersonate legitimate packages related to financial or blockchain services. The fact that all these packages were published only hours before their disclosure points to a rapid deployment strategy by the attackers.

While specific behavioral findings from OpenSSF Package Analysis are not detailed in the advisories, all thirteen packages were assigned a 'Critical' severity rating. This typically indicates that the malicious code could lead to severe consequences for affected systems, such as remote code execution, credential exfiltration, or complete system compromise. The rapid disclosure and critical severity suggest that these packages likely contained highly impactful payloads designed to exploit unsuspecting users.

The 'Critical' severity assigned to all these advisories means that any system that installed these packages should be considered fully compromised. Users are strongly advised to treat such systems as untrusted, immediately rotate all sensitive credentials (such as API keys, tokens, and passwords) from a separate, secure machine, and thoroughly audit their environments for any signs of further compromise.

Developers should immediately audit their package-lock.json or yarn.lock files for the presence of any of the disclosed malicious packages. A representative list includes:

• scw-mobile
• base-account-core
• cb-wallet-data
• cb-wallet-solana-provider
• wallet-engine-signing

If any of these packages are found, they must be removed, and all credentials associated with the build and deployment pipelines should be rotated. Additionally, administrators should review npm token logs for any unauthorized publish activity.

This coordinated drop of themed, freshly published malicious packages within an extremely tight window highlights the persistent threat of supply chain attacks targeting package registries. Attackers continue to leverage impersonation and rapid deployment to distribute malware, emphasizing the need for continuous vigilance and robust security practices within the software development ecosystem.