MAL-2026-12329

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@shiftmarkets/shift-sdk-v4/MAL-2026-12329.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12329
Published
2026-08-05T13:02:35Z
Modified
2026-08-05T13:34:52.597715387Z
Summary
Malicious code in @shiftmarkets/shift-sdk-v4 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1bff275a2558640accb1a6956b933b71930ece1240bd8c5a0c2e00f74fc2fa82)

The package declares a postinstall script node dist/recon.js that runs automatically on npm install. The script collects installer-side reconnaissance data — hostname, username, SUDO_USER, home directory, current working directory, all local IPv4 addresses (including internal interfaces), DNS domain (via dnsdomainname), CI-provider flags, the full sorted list of process.env variable names, and a filtered subset of environment variable names matching secret/credential regex patterns — and POSTs the JSON payload over plain HTTP to the hardcoded bare IPv4 endpoint http://138.68.108.20:80/cb. An in-file comment frames the beacon as 'NON-SENSITIVE telemetry', but the destination is a bare IP with no publisher affiliation and the payload includes internal network topology and credential-shaped env variable names. The package presents itself as a scoped Shift Forex build compatible with the public shift-sdk-v4 package and ships a minimal API-compatible stub in dist/index.js, consistent with a dependency-confusion lure against consumers who reference shift-sdk-v4 from an internal registry.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T13:02:35Z",
            "id": "IN-MAL-2026-014860",
            "import_time": "2026-08-05T13:08:51.593814366Z",
            "versions": [
                "1.0.77"
            ],
            "source": "amazon-inspector",
            "sha256": "1bff275a2558640accb1a6956b933b71930ece1240bd8c5a0c2e00f74fc2fa82"
        }
    ]
}
References
Credits

Affected packages

npm / @shiftmarkets/shift-sdk-v4

Package

Name
@shiftmarkets/shift-sdk-v4
View open source insights on deps.dev
Purl
pkg:npm/%40shiftmarkets/shift-sdk-v4

Affected ranges

Affected versions

1.*
1.0.77

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-1x8hlIt9WEBbFPqx/kSPa6+1uhCuWAWlCMUkHk6OchDmUsrQ6VF7zXPzYBVAK/H72nAc0WaB3kdjgG1dGYwGmQ==",
                "sha1": "2baa5e4ca624db406fdf0a48b618ebf2c1ba4db5"
            },
            "filename": "shift-sdk-v4-1.0.77.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "dist/recon.js",
            "tlsh": "0c51845612b92532229256a9366b10013233f0273f85f9d8bddc13611fcd42d41f6bed",
            "sha256": "cf516a4fddaeeec18aa158b24503fb532cb928411b6720ee31516e9b00510057"
        },
        {
            "path": "package.json",
            "tlsh": "3cf0e5288428983334d417aa2c61aa46b9308d1f456b380837db129c875e3f7a4ff37d",
            "sha256": "32539f9fb78f0420c3d03a19cc5870a77f0d7a22e23213dc7bfa4d90223cdd18"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@shiftmarkets/shift-sdk-v4/MAL-2026-12329.json"