MAL-2026-12329
Dashboard / Malicious Package / MAL-2026-12329
MAL-2026-12329
Summary: Malicious code in @shiftmarkets/shift-sdk-v4 (npm)
Details: Source: amazon-inspector (1bff275a2558640accb1a6956b933b71930ece1240bd8c5a0c2e00f74fc2fa82) The package declares a postinstall script `node dist/recon.js` that runs automatically on `npm install`. The script collects installer-side reconnaissance data — hostname, username, SUDO_USER, home directory, current working directory, all local IPv4 addresses (including internal interfaces), DNS domain (via `dnsdomainname`), CI-provider flags, the full sorted list of `process.env` variable names, and a filtered subset of environment variable names matching secret/credential regex patterns — and POSTs the JSON payload over plain HTTP to the hardcoded bare IPv4 endpoint `http://138.68.108.20:80/cb`. An in-file comment frames the beacon as 'NON-SENSITIVE telemetry', but the destination is a bare IP with no publisher affiliation and the payload includes internal network topology and credential-shaped env variable names. The package presents itself as a scoped Shift Forex build compatible with the public `shift-sdk-v4` package and ships a minimal API-compatible stub in `dist/index.js`, consistent with a dependency-confusion lure against consumers who reference `shift-sdk-v4` from an internal registry.
Affected packages
Package
Name: @shiftmarkets/shift-sdk-v4
Purl: pkg:npm/%40shiftmarkets/shift-sdk-v4
Affected ranges
Type: N/A
Events:
