@cryptosrvc/shift-sdk-v4

{"modified":"2026-08-05T13:01:22Z","published":"2026-08-05T13:01:22Z","schema_version":"1.7.4","id":"MAL-2026-12317","summary":"Malicious code in @cryptosrvc/shift-sdk-v4 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bbcb95c5f9f9305e86cbeb749787dc845933c6273e91ab2d69138dee6fc2900a)\npackage.json declares a postinstall script `node dist/recon.js || true` that runs automatically on npm install. dist/recon.js collects installer host identity (hostname, username, SUDO_USER, homedir, cwd, platform/arch/release, node version), all internal and external IPv4 addresses from every network interface, the DNS domain via `dnsdomainname`, CI-provider indicators, and the full list of process.env variable names with a subset matching AWS|NPM|TOKEN|SECRET|KEY|GITHUB|SSH flagged as secret-shaped. The data is POSTed as JSON over plain HTTP to the hardcoded bare IP http://138.68.108.20:80/cb with a 4-second timeout and errors silently swallowed to preserve install success. A source comment frames the behavior as 'NON-SENSITIVE telemetry only', contradicting the actual enumeration of sudo user, network topology, and env-var names. The destination is an unattributed DigitalOcean IP with no relationship to any legitimate SDK publisher.\n","affected":[{"package":{"ecosystem":"npm","name":"@cryptosrvc/shift-sdk-v4"},"versions":["1.0.77"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/recon.js","sha256":"cf516a4fddaeeec18aa158b24503fb532cb928411b6720ee31516e9b00510057","tlsh":"0c51845612b92532229256a9366b10013233f0273f85f9d8bddc13611fcd42d41f6bed"}],"package_integrity":[{"filename":"shift-sdk-v4-1.0.77.tgz","hashes":{"sha1":"371be6b180608edf4708c372f9c5c1e9b693e352","sha512_sri":"sha512-2imnn0EWUI5Un7WbZa8pO7NdjhRM/2GKRDHuU3gh6apsNS9yGk2sTYU2gueenenLbTJ7H0s24nyj96YkFbxYqQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@cryptosrvc/shift-sdk-v4/v/1.0.77"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014851","import_time":"2026-08-05T13:08:51.08055936Z","modified_time":"2026-08-05T13:01:22Z","sha256":"bbcb95c5f9f9305e86cbeb749787dc845933c6273e91ab2d69138dee6fc2900a","source":"amazon-inspector","versions":["1.0.77"]}]}}