GCVE-110-OSM-2026-4298

Beacons package name and Node.js version to attacker-controlled Cloudflare Worker infrastructure at icy-cell-fb53.gh0stfqce25.workers.dev via dual triggers: a postinstall hook firing at npm install time and an IIFE in index.js firing at require-time. The package impersonates an internal Coinbase Base chain account layer namespace and includes a fake 'RESERVED PLACEHOLDER — coordinated security-research namespace claim' deniability cover in its description. The C2 domain is shared with sibling packages scw-mobile and cb-wallet-solana-provider published by the same actor (npm username gh0stfqce). **Trigger (postinstall)**: `node postinstall.js` executes at `npm install` via the postinstall lifecycle hook. **Beacon (install-time)**: `https.get()` fires a GET request to `https://icy-cell-fb53.gh0stfqce25.workers.dev/poc` with package name and Node.js version as query parameters (`p` and `n`). **Trigger (require-time)**: an IIFE in `index.js` executes on `require('base-account-core')`. **Beacon (require-time)**: identical GET to the same C2 endpoint with `h=runtime` parameter. **Response**: CF Worker returns `ok`; no second-stage payload delivered.