MAL-2026-12317

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@cryptosrvc/shift-sdk-v4/MAL-2026-12317.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12317
Published
2026-08-05T13:01:22Z
Modified
2026-08-05T13:35:08.779075988Z
Summary
Malicious code in @cryptosrvc/shift-sdk-v4 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bbcb95c5f9f9305e86cbeb749787dc845933c6273e91ab2d69138dee6fc2900a)

package.json declares a postinstall script node dist/recon.js || true that runs automatically on npm install. dist/recon.js collects installer host identity (hostname, username, SUDO_USER, homedir, cwd, platform/arch/release, node version), all internal and external IPv4 addresses from every network interface, the DNS domain via dnsdomainname, CI-provider indicators, and the full list of process.env variable names with a subset matching AWS|NPM|TOKEN|SECRET|KEY|GITHUB|SSH flagged as secret-shaped. The data is POSTed as JSON over plain HTTP to the hardcoded bare IP http://138.68.108.20:80/cb with a 4-second timeout and errors silently swallowed to preserve install success. A source comment frames the behavior as 'NON-SENSITIVE telemetry only', contradicting the actual enumeration of sudo user, network topology, and env-var names. The destination is an unattributed DigitalOcean IP with no relationship to any legitimate SDK publisher.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "bbcb95c5f9f9305e86cbeb749787dc845933c6273e91ab2d69138dee6fc2900a",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T13:08:51.08055936Z",
            "modified_time": "2026-08-05T13:01:22Z",
            "versions": [
                "1.0.77"
            ],
            "id": "IN-MAL-2026-014851"
        }
    ]
}
References
Credits

Affected packages

npm / @cryptosrvc/shift-sdk-v4

Package

Name
@cryptosrvc/shift-sdk-v4
View open source insights on deps.dev
Purl
pkg:npm/%40cryptosrvc/shift-sdk-v4

Affected ranges

Affected versions

1.*
1.0.77

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "371be6b180608edf4708c372f9c5c1e9b693e352",
                "sha512_sri": "sha512-2imnn0EWUI5Un7WbZa8pO7NdjhRM/2GKRDHuU3gh6apsNS9yGk2sTYU2gueenenLbTJ7H0s24nyj96YkFbxYqQ=="
            },
            "filename": "shift-sdk-v4-1.0.77.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "dist/recon.js",
            "sha256": "cf516a4fddaeeec18aa158b24503fb532cb928411b6720ee31516e9b00510057",
            "tlsh": "0c51845612b92532229256a9366b10013233f0273f85f9d8bddc13611fcd42d41f6bed"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@cryptosrvc/shift-sdk-v4/MAL-2026-12317.json"