MAL-2026-12316

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@cryptosrvc/shift-exchange-root/MAL-2026-12316.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12316
Published
2026-08-05T13:07:03Z
Modified
2026-08-05T13:35:08.504559950Z
Summary
Malicious code in @cryptosrvc/shift-exchange-root (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5ff6c468a083fe963c94caf5edbd3b36e83ba753c9c2d14c807f6a4bb3b6048a)

On npm install, the package runs dist/recon.js as a postinstall script that collects the installer's hostname, username, SUDO_USER, home directory, current working directory, all local network interface IPs (including internal addresses), DNS domain, the full list of environment variable names, a filtered subset of env var names matching credential keywords (AWS, GCP, AZURE, NPM, TOKEN, SECRET, KEY, PASS, GITHUB, SSH), and CI indicators, and POSTs the JSON payload over plain HTTP to the hardcoded DigitalOcean address 138.68.108.20:80/cb. The file's header comment labels the collection as 'NON-SENSITIVE telemetry only' and the outgoing User-Agent is 'npm-install-telemetry/1.0', while the package's declared main entry (dist/index.js) is a math-utility stub unrelated to any telemetry function. The scope @cryptosrvc/shift-exchange-root resembles the legitimate @shiftforex/shift-exchange-root, consistent with a dependency-confusion or typosquat lure. Host identity plus internal network topology plus enumerated credential-shaped env var names constitute reconnaissance data suitable for follow-on targeted attacks against the installing environment.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "5e28539828e6bc5744f800fcf391942b34dff18987d9d10bee311c4caf995571",
            "source": "amazon-inspector",
            "versions": [
                "3.9.9"
            ],
            "import_time": "2026-08-05T13:08:53.208395444Z",
            "modified_time": "2026-08-05T13:07:10Z",
            "id": "IN-MAL-2026-014889"
        },
        {
            "sha256": "5ff6c468a083fe963c94caf5edbd3b36e83ba753c9c2d14c807f6a4bb3b6048a",
            "source": "amazon-inspector",
            "versions": [
                "2.9.9"
            ],
            "import_time": "2026-08-05T13:08:53.159354802Z",
            "modified_time": "2026-08-05T13:07:03Z",
            "id": "IN-MAL-2026-014888"
        },
        {
            "sha256": "b583974e9a8d75ea3eb5be38cd1541eeb8f1a310af500b15dd3ec618645125ec",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T13:08:53.264048813Z",
            "modified_time": "2026-08-05T13:07:20Z",
            "versions": [
                "1.9.9"
            ],
            "id": "IN-MAL-2026-014890"
        }
    ]
}
References
Credits

Affected packages

npm / @cryptosrvc/shift-exchange-root

Package

Name
@cryptosrvc/shift-exchange-root
View open source insights on deps.dev
Purl
pkg:npm/%40cryptosrvc/shift-exchange-root

Affected ranges

Affected versions

1.*
1.9.9
2.*
2.9.9
3.*
3.9.9

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "b8c7453f886ea69cb83fa2f82b3699494fcbb38b",
                "sha512_sri": "sha512-RiDJBEPXDExGZOlIREf+X9uKsry6kYbsa3qCMv63gkQKwJKWMFJFL+UBz+5hmI9qOOfrkHBpIvw48+Q+dWPIdw=="
            },
            "filename": "shift-exchange-root-3.9.9.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "dist/recon.js",
            "sha256": "cf516a4fddaeeec18aa158b24503fb532cb928411b6720ee31516e9b00510057",
            "tlsh": "0c51845612b92532229256a9366b10013233f0273f85f9d8bddc13611fcd42d41f6bed"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@cryptosrvc/shift-exchange-root/MAL-2026-12316.json"