registry / Data exfiltration / @shiftmarkets/no-brainer-sdk
@shiftmarkets/no-brainer-sdk
No Brainer SDK — GraphQL type generator (Shift Forex scoped build)
This report shows the evidence for @shiftmarkets/no-brainer-sdk@1.0.18, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is concrete, unconsented install-time reconnaissance and exfiltration unrelated to the advertised GraphQL generator.
Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall
Impact
Leaks developer/CI host identity, local network addresses, paths, user names, and environment-variable inventory.
Mechanism
postinstall host fingerprinting and HTTP exfiltration
Attack narrative
On installation, package.json invokes dist/recon.js. That script inventories host and CI details, usernames, home and working directories, IPv4 interfaces, DNS domain, and all environment-variable names including names suggestive of credentials, then POSTs the JSON to a hard-coded external IP. Error suppression prevents installation from signaling the activity.
AI rationale
This is concrete, unconsented install-time reconnaissance and exfiltration unrelated to the advertised GraphQL generator.
Evidence
package.jsondist/recon.jsdist/index.js
Network endpoints1
138.68.108.20:80/cb
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs dist/recon.js in postinstall.
- dist/recon.js sends install telemetry to 138.68.108.20:80/cb.
- It collects hostname, usernames, home/cwd, network IPs, DNS domain, and environment-variable names.
- The probe runs automatically and suppresses errors with || true.
Evidence against
- dist/index.js is a user-invoked GraphQL type generator.
- The CLI only contacts the endpoint supplied by its user.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node dist/recon.js || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node dist/recon.js || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/recon.jsView file
8const http = require("http");
L9: const { execSync } = require("child_process");
L10:
High
Findings
5 High3 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/recon.js
HighShell
HighSame File Env Network Executiondist/recon.js
HighHost Fingerprint Exfiltrationdist/recon.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @shiftmarkets/no-brainer-sdk@1.0.18.
The versions list below shows the verdict for each recorded version.
- Avoid installing @shiftmarkets/no-brainer-sdk@1.0.18. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.