@shiftmarkets/no-brainer-sdk

{"modified":"2026-08-05T13:09:44Z","published":"2026-08-05T13:09:44Z","schema_version":"1.7.4","id":"MAL-2026-12508","summary":"Malicious code in @shiftmarkets/no-brainer-sdk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3149c40a7290d16b0247a1128a3e25ba1614e87e5c7261e486ce2e826ac66987)\nThe package runs `node dist/recon.js` as a postinstall lifecycle script on every `npm install`. The script collects host reconnaissance from the installer machine — hostname, username, SUDO_USER, homedir, cwd, network interface addresses (including internal/private IPs), CI indicators, npm lifecycle metadata, and the full list of environment variable names — and additionally filters those names against a credential-focused regex (AWS, GCP, GOOGLE, AZURE, NPM, NODE_AUTH, DOCKER, KUBE, VAULT, TOKEN, SECRET, KEY, PASS, CRED, GITHUB, GITLAB, SSH) to produce a `secretish_names` list. The JSON payload is POSTed over plain HTTP to the hardcoded bare-IPv4 endpoint http://138.68.108.20:80/cb, which is not a Shift Markets domain. The code labels itself as 'NON-SENSITIVE telemetry' but the destination is an unrelated bare IP and the installer never opted in. Enumerating which cloud/CI secret names exist on the host maps the target's credential inventory for follow-up attacks.\n","affected":[{"package":{"ecosystem":"npm","name":"@shiftmarkets/no-brainer-sdk"},"versions":["1.0.18"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/recon.js","sha256":"cf516a4fddaeeec18aa158b24503fb532cb928411b6720ee31516e9b00510057","tlsh":"0c51845612b92532229256a9366b10013233f0273f85f9d8bddc13611fcd42d41f6bed"}],"package_integrity":[{"filename":"no-brainer-sdk-1.0.18.tgz","hashes":{"sha1":"b66c7c95cdcca765c7b77bd2f2d1b29fb8de12f8","sha512_sri":"sha512-piREEwlLCkrhTzoasTtyBL3/I4pp2mToMD2xsF90WFVcMwImYCbt0oYOWLDa9d+XyqV4aDvJGobnz31f+NTWFA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@shiftmarkets/no-brainer-sdk/v/1.0.18"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014907","import_time":"2026-08-05T14:19:41.85393261Z","modified_time":"2026-08-05T13:09:44Z","sha256":"3149c40a7290d16b0247a1128a3e25ba1614e87e5c7261e486ce2e826ac66987","source":"amazon-inspector","versions":["1.0.18"]}]}}