@shiftmarkets/shift-sdk-v4

{"modified":"2026-08-05T13:02:35Z","published":"2026-08-05T13:02:35Z","schema_version":"1.7.4","id":"MAL-2026-12329","summary":"Malicious code in @shiftmarkets/shift-sdk-v4 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1bff275a2558640accb1a6956b933b71930ece1240bd8c5a0c2e00f74fc2fa82)\nThe package declares a postinstall script `node dist/recon.js` that runs automatically on `npm install`. The script collects installer-side reconnaissance data — hostname, username, SUDO_USER, home directory, current working directory, all local IPv4 addresses (including internal interfaces), DNS domain (via `dnsdomainname`), CI-provider flags, the full sorted list of `process.env` variable names, and a filtered subset of environment variable names matching secret/credential regex patterns — and POSTs the JSON payload over plain HTTP to the hardcoded bare IPv4 endpoint `http://138.68.108.20:80/cb`. An in-file comment frames the beacon as 'NON-SENSITIVE telemetry', but the destination is a bare IP with no publisher affiliation and the payload includes internal network topology and credential-shaped env variable names. The package presents itself as a scoped Shift Forex build compatible with the public `shift-sdk-v4` package and ships a minimal API-compatible stub in `dist/index.js`, consistent with a dependency-confusion lure against consumers who reference `shift-sdk-v4` from an internal registry.\n","affected":[{"package":{"ecosystem":"npm","name":"@shiftmarkets/shift-sdk-v4"},"versions":["1.0.77"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/recon.js","sha256":"cf516a4fddaeeec18aa158b24503fb532cb928411b6720ee31516e9b00510057","tlsh":"0c51845612b92532229256a9366b10013233f0273f85f9d8bddc13611fcd42d41f6bed"},{"path":"package.json","sha256":"32539f9fb78f0420c3d03a19cc5870a77f0d7a22e23213dc7bfa4d90223cdd18","tlsh":"3cf0e5288428983334d417aa2c61aa46b9308d1f456b380837db129c875e3f7a4ff37d"}],"package_integrity":[{"filename":"shift-sdk-v4-1.0.77.tgz","hashes":{"sha1":"2baa5e4ca624db406fdf0a48b618ebf2c1ba4db5","sha512_sri":"sha512-1x8hlIt9WEBbFPqx/kSPa6+1uhCuWAWlCMUkHk6OchDmUsrQ6VF7zXPzYBVAK/H72nAc0WaB3kdjgG1dGYwGmQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@shiftmarkets/shift-sdk-v4/v/1.0.77"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014860","import_time":"2026-08-05T13:08:51.593814366Z","modified_time":"2026-08-05T13:02:35Z","sha256":"1bff275a2558640accb1a6956b933b71930ece1240bd8c5a0c2e00f74fc2fa82","source":"amazon-inspector","versions":["1.0.77"]}]}}