OpenSSF/OSV advisory MAL-2026-12802 confirms this npm version as malicious. shift-v4-sdk@1.0.5 is a typosquat of the scoped package @shiftforex/shift-sdk-v4 (self-identified as such in a comment inside dist/index.js). Its postinstall script dist/recon.js runs automatically on npm install and collects the installer's hostname, user, sudo_user, home directory, cwd, DNS domain (via dnsdomainname), network interfaces and IP addresses, the full list of process.env variable names, and a filtered...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in shift-v4-sdk (npm)
Details
shift-v4-sdk@1.0.5 is a typosquat of the scoped package @shiftforex/shift-sdk-v4 (self-identified as such in a comment inside dist/index.js). Its postinstall script dist/recon.js runs automatically on npm install and collects the installer's hostname, user, sudo_user, home directory, cwd, DNS domain (via dnsdomainname), network interfaces and IP addresses, the full list of process.env variable names, and a filtered subset of env-var names matching credential-shaped patterns (AWS, GCP, AZURE, NPM, TOKEN, SECRET, KEY, PASS, CRED, GITHUB, GITLAB, SSH). The JSON blob is POSTed over plaintext HTTP to http://138.68.108.20/cb. An in-file comment framing this as 'non-sensitive telemetry' contradicts the actual behavior (host fingerprint plus secret-shaped env-var name enumeration is reconnaissance for follow-on targeting).
Decision reason
OpenSSF Malicious Packages via OSV confirms shift-v4-sdk@1.0.5 as malicious (MAL-2026-12802): Malicious code in shift-v4-sdk (npm)