Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@shiftmarkets/no-brainer-sdk@1.0.18: Malicious npm security | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Blocked & quarantined

Leaks developer/CI host identity, local network addresses, paths, user names, and environment-variable inventory.

View on npm All versions

registry / @shiftmarkets/no-brainer-sdk / 1.0.18

@shiftmarkets/no-brainer-sdk@1.0.18

No Brainer SDK — GraphQL type generator (Shift Forex scoped build)

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Automatic npm installation executes a host-reconnaissance probe and exfiltrates collected machine metadata. The CLI itself is separately user-invoked.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

Leaks developer/CI host identity, local network addresses, paths, user names, and environment-variable inventory.

Mechanism

postinstall host fingerprinting and HTTP exfiltration

Attack narrative

On installation, package.json invokes dist/recon.js. That script inventories host and CI details, usernames, home and working directories, IPv4 interfaces, DNS domain, and all environment-variable names including names suggestive of credentials, then POSTs the JSON to a hard-coded external IP. Error suppression prevents installation from signaling the activity.

Rationale

This is concrete, unconsented install-time reconnaissance and exfiltration unrelated to the advertised GraphQL generator.

Evidence

package.jsondist/recon.jsdist/index.js

Network endpoints1

138.68.108.20:80/cb

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

Evidence for block

package.json runs dist/recon.js in postinstall.
dist/recon.js sends install telemetry to 138.68.108.20:80/cb.
It collects hostname, usernames, home/cwd, network IPs, DNS domain, and environment-variable names.
The probe runs automatically and suppresses errors with || true.

Evidence against

dist/index.js is a user-invoked GraphQL type generator.
The CLI only contacts the endpoint supplied by its user.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 5.05 KB of source

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/recon.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/recon.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/recon.jsView file

8const http = require("http"); L9: const { execSync } = require("child_process"); L10:

High

Child Process

Package source references child process execution.

dist/recon.jsView on unpkg · L8

7const os = require("os"); L8: const http = require("http"); L9: const { execSync } = require("child_process"); L10: ... L16: try { L17: const envNames = Object.keys(process.env).sort(); L18: const ciFlags = ["CI", "CONTINUOUS_INTEGRATION", "GITHUB_ACTIONS", "GITLAB_CI",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/recon.jsView on unpkg · L7

7const os = require("os"); L8: const http = require("http"); L9: const { execSync } = require("child_process"); L10: ... L16: try { L17: const envNames = Object.keys(process.env).sort(); L18: const ciFlags = ["CI", "CONTINUOUS_INTEGRATION", "GITHUB_ACTIONS", "GITLAB_CI", L19: "JENKINS_URL", "JENKINS_HOME", "BUILDKITE", "TF_BUILD", "CIRCLECI", ... L29: try { L30: const ifs = os.networkInterfaces(); L31: for (const [name, addrs] of Object.entries(ifs)) { ... L45: try {

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/recon.jsView on unpkg · L7

Findings

5 High3 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/recon.js

HighShell

HighSame File Env Network Executiondist/recon.js

HighHost Fingerprint Exfiltrationdist/recon.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

99%Block

Verdict confidence

IntentMalware

TypeData Exfiltration

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched malicious

Package metadata

npm

Authorshift-devtools

Version1.0.18

PublishedJul 24, 2026

LicenseISC

Dependencies0

Integrityverified

Package size2.57 KB

Files3

Keywordsshiftforexgraphqlcodegen

Runtime surface

package.json

Entrypointsmain → dist/index.jsbin → no-brainer-sdk

RuntimeNo engine / OS / CPU constraints

Artifact5.52 KB · 3 files1 signature(s)

Install lifecyclepostinstall

Behavioral surface

ChildProcessEnvironmentVarsFilesystemNetworkShellSupply chain: cleanManifest: clean

LPM CLI

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall = node dist/recon.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/recon.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/recon.jsView file

8const http = require("http"); L9: const { execSync } = require("child_process"); L10:

High

Child Process

Package source references child process execution.

dist/recon.jsView on unpkg · L8

7const os = require("os"); L8: const http = require("http"); L9: const { execSync } = require("child_process"); L10: ... L16: try { L17: const envNames = Object.keys(process.env).sort(); L18: const ciFlags = ["CI", "CONTINUOUS_INTEGRATION", "GITHUB_ACTIONS", "GITLAB_CI",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/recon.jsView on unpkg · L7

7const os = require("os"); L8: const http = require("http"); L9: const { execSync } = require("child_process"); L10: ... L16: try { L17: const envNames = Object.keys(process.env).sort(); L18: const ciFlags = ["CI", "CONTINUOUS_INTEGRATION", "GITHUB_ACTIONS", "GITLAB_CI", L19: "JENKINS_URL", "JENKINS_HOME", "BUILDKITE", "TF_BUILD", "CIRCLECI", ... L29: try { L30: const ifs = os.networkInterfaces(); L31: for (const [name, addrs] of Object.entries(ifs)) { ... L45: try {

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/recon.jsView on unpkg · L7