MAL-2026-12802

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/shift-v4-sdk/MAL-2026-12802.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12802
Published
2026-08-05T13:18:42Z
Modified
2026-08-05T14:37:20Z
Summary
Malicious code in shift-v4-sdk (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e86de9ce7bfa06a95a3e4d6c68f188d2c8c8b35537645e94a2fb3fee4c1e0e81)

shift-v4-sdk@1.0.5 is a typosquat of the scoped package @shiftforex/shift-sdk-v4 (self-identified as such in a comment inside dist/index.js). Its postinstall script dist/recon.js runs automatically on npm install and collects the installer's hostname, user, sudo_user, home directory, cwd, DNS domain (via dnsdomainname), network interfaces and IP addresses, the full list of process.env variable names, and a filtered subset of env-var names matching credential-shaped patterns (AWS, GCP, AZURE, NPM, TOKEN, SECRET, KEY, PASS, CRED, GITHUB, GITLAB, SSH). The JSON blob is POSTed over plaintext HTTP to http://138.68.108.20/cb. An in-file comment framing this as 'non-sensitive telemetry' contradicts the actual behavior (host fingerprint plus secret-shaped env-var name enumeration is reconnaissance for follow-on targeting).

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014968",
            "import_time": "2026-08-05T14:19:47.804485678Z",
            "modified_time": "2026-08-05T13:18:42Z",
            "sha256": "e86de9ce7bfa06a95a3e4d6c68f188d2c8c8b35537645e94a2fb3fee4c1e0e81",
            "source": "amazon-inspector",
            "versions": [
                "1.0.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / shift-v4-sdk

Package

Name
shift-v4-sdk
View open source insights on deps.dev
Purl
pkg:npm/shift-v4-sdk

Affected ranges

Affected versions

1.*
1.0.5

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "dist/recon.js",
            "sha256": "cf516a4fddaeeec18aa158b24503fb532cb928411b6720ee31516e9b00510057",
            "tlsh": "0c51845612b92532229256a9366b10013233f0273f85f9d8bddc13611fcd42d41f6bed"
        },
        {
            "path": "dist/index.js",
            "sha256": "5fb9be0f0e3d505fe63c61660e383aaf2694255ee9623ac6cf8e0da823c67db8",
            "tlsh": "b521408961b3317055f3bfae8a9644517a60b41764cfac047acc82ed8f09a1c48a6da9"
        }
    ],
    "package_integrity": [
        {
            "filename": "shift-v4-sdk-1.0.5.tgz",
            "hashes": {
                "sha1": "5a284d752d69ce4a98ac444263982250a8a5061c",
                "sha512_sri": "sha512-H9asry7q85L/Zn3m5X4w8YhsKkOPOsonW+sN1rwsk8GMjPCaU3RwHWW6+FnQNdDLsriB3Z6bCCA3mz9ijtLfvA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/shift-v4-sdk/MAL-2026-12802.json"