registry / @shiftmarkets/shift-sdk-v4 / 1.0.77

@shiftmarkets/shift-sdk-v4@1.0.77

Shift SDK v4 — trading API client (Shift Forex scoped build)

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Installing the package automatically fingerprints the host and exfiltrates the result to a hard-coded IP address. This is unrelated to the SDK's caller-configured API functionality.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

Unconsented disclosure of workstation/CI identity, local network addresses, paths, usernames, and environment metadata.

Mechanism

silent install-time host reconnaissance and HTTP exfiltration

Attack narrative

On installation, the postinstall hook invokes dist/recon.js. It gathers hostname, username, home directory, current directory, internal interfaces/IPs, DNS domain, CI indicators, and all environment-variable names, then sends the JSON payload to a hard-coded external IP over HTTP. Error suppression keeps the install successful if collection or transmission fails.

Rationale

The package contains a concrete, automatic, non-package-aligned host-fingerprinting exfiltration chain at install time. The normal SDK entrypoint does not justify this hidden telemetry.

Evidence

package.jsondist/recon.jsdist/index.js

Network endpoints1

138.68.108.20:80/cb

Decision evidence

public snapshot

AI called this at 99.0% confidence with false-positive risk.

@shiftmarkets/shift-sdk-v4@1.0.77

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code