{"id":"MAL-2026-12317","summary":"Malicious code in @cryptosrvc/shift-sdk-v4 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bbcb95c5f9f9305e86cbeb749787dc845933c6273e91ab2d69138dee6fc2900a)\npackage.json declares a postinstall script `node dist/recon.js || true` that runs automatically on npm install. dist/recon.js collects installer host identity (hostname, username, SUDO_USER, homedir, cwd, platform/arch/release, node version), all internal and external IPv4 addresses from every network interface, the DNS domain via `dnsdomainname`, CI-provider indicators, and the full list of process.env variable names with a subset matching AWS|NPM|TOKEN|SECRET|KEY|GITHUB|SSH flagged as secret-shaped. The data is POSTed as JSON over plain HTTP to the hardcoded bare IP http://138.68.108.20:80/cb with a 4-second timeout and errors silently swallowed to preserve install success. A source comment frames the behavior as 'NON-SENSITIVE telemetry only', contradicting the actual enumeration of sudo user, network topology, and env-var names. The destination is an unattributed DigitalOcean IP with no relationship to any legitimate SDK publisher.\n","modified":"2026-08-05T13:35:08.779075988Z","published":"2026-08-05T13:01:22Z","database_specific":{"malicious-packages-origins":[{"sha256":"bbcb95c5f9f9305e86cbeb749787dc845933c6273e91ab2d69138dee6fc2900a","source":"amazon-inspector","versions":["1.0.77"],"id":"IN-MAL-2026-014851","import_time":"2026-08-05T13:08:51.08055936Z","modified_time":"2026-08-05T13:01:22Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@cryptosrvc/shift-sdk-v4/v/1.0.77"}],"affected":[{"package":{"name":"@cryptosrvc/shift-sdk-v4","ecosystem":"npm","purl":"pkg:npm/%40cryptosrvc/shift-sdk-v4"},"versions":["1.0.77"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"tlsh":"0c51845612b92532229256a9366b10013233f0273f85f9d8bddc13611fcd42d41f6bed","path":"dist/recon.js","sha256":"cf516a4fddaeeec18aa158b24503fb532cb928411b6720ee31516e9b00510057"}],"package_integrity":[{"hashes":{"sha1":"371be6b180608edf4708c372f9c5c1e9b693e352","sha512_sri":"sha512-2imnn0EWUI5Un7WbZa8pO7NdjhRM/2GKRDHuU3gh6apsNS9yGk2sTYU2gueenenLbTJ7H0s24nyj96YkFbxYqQ=="},"filename":"shift-sdk-v4-1.0.77.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@cryptosrvc/shift-sdk-v4/MAL-2026-12317.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}