npm scope
@shiftmarkets
LPM Firewall blocks 3 packages in the @shiftmarkets npm scope. 2 have LPM's own review and are listed first.
Jul 24, 2026
@shiftmarkets/shift-sdk-v4@1.0.77
Data exfiltrationThe package contains a concrete, automatic, non-package-aligned host-fingerprinting exfiltration chain at install time. The normal SDK entrypoint does not justify this hidden telemetry.
Jul 24, 2026
@shiftmarkets/no-brainer-sdk@1.0.18
Data exfiltrationThis is concrete, unconsented install-time reconnaissance and exfiltration unrelated to the advertised GraphQL generator.
Aug 5, 2026
@shiftmarkets/shift-exchange-root@3.9.9
MalwareOpenSSF Malicious Packages via OSV confirms @shiftmarkets/shift-exchange-root@3.9.9 as malicious (MAL-2026-12509): Malicious code in @shiftmarkets/shift-exchange-root (npm)
Each card opens the package page with its evidence and every recorded version.