{"id":"MAL-2026-12802","summary":"Malicious code in shift-v4-sdk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e86de9ce7bfa06a95a3e4d6c68f188d2c8c8b35537645e94a2fb3fee4c1e0e81)\nshift-v4-sdk@1.0.5 is a typosquat of the scoped package @shiftforex/shift-sdk-v4 (self-identified as such in a comment inside dist/index.js). Its postinstall script dist/recon.js runs automatically on npm install and collects the installer's hostname, user, sudo_user, home directory, cwd, DNS domain (via dnsdomainname), network interfaces and IP addresses, the full list of process.env variable names, and a filtered subset of env-var names matching credential-shaped patterns (AWS, GCP, AZURE, NPM, TOKEN, SECRET, KEY, PASS, CRED, GITHUB, GITLAB, SSH). The JSON blob is POSTed over plaintext HTTP to http://138.68.108.20/cb. An in-file comment framing this as 'non-sensitive telemetry' contradicts the actual behavior (host fingerprint plus secret-shaped env-var name enumeration is reconnaissance for follow-on targeting).\n","modified":"2026-08-05T14:37:20.448410780Z","published":"2026-08-05T13:18:42Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.5"],"id":"IN-MAL-2026-014968","import_time":"2026-08-05T14:19:47.804485678Z","modified_time":"2026-08-05T13:18:42Z","sha256":"e86de9ce7bfa06a95a3e4d6c68f188d2c8c8b35537645e94a2fb3fee4c1e0e81"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/shift-v4-sdk/v/1.0.5"}],"affected":[{"package":{"name":"shift-v4-sdk","ecosystem":"npm","purl":"pkg:npm/shift-v4-sdk"},"versions":["1.0.5"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/shift-v4-sdk/MAL-2026-12802.json","indicators":{"package_integrity":[{"filename":"shift-v4-sdk-1.0.5.tgz","hashes":{"sha1":"5a284d752d69ce4a98ac444263982250a8a5061c","sha512_sri":"sha512-H9asry7q85L/Zn3m5X4w8YhsKkOPOsonW+sN1rwsk8GMjPCaU3RwHWW6+FnQNdDLsriB3Z6bCCA3mz9ijtLfvA=="}}],"evidence_files":[{"tlsh":"0c51845612b92532229256a9366b10013233f0273f85f9d8bddc13611fcd42d41f6bed","path":"dist/recon.js","sha256":"cf516a4fddaeeec18aa158b24503fb532cb928411b6720ee31516e9b00510057"},{"tlsh":"b521408961b3317055f3bfae8a9644517a60b41764cfac047acc82ed8f09a1c48a6da9","path":"dist/index.js","sha256":"5fb9be0f0e3d505fe63c61660e383aaf2694255ee9623ac6cf8e0da823c67db8"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}