{"answers":{"affected":"1 open source package ship an affected version, including @cryptosrvc/shift-exchange-root.","exploited":"There is no known exploitation of MAL-2026-12316 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12316 is a malicious package in @cryptosrvc/shift-exchange-root, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12316 is a malicious package: @cryptosrvc/shift-exchange-root (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12316/ (Markdown: https://insights.sbomify.com/MAL-2026-12316/index.md)","id":"MAL-2026-12316","markdown":"https://insights.sbomify.com/MAL-2026-12316/index.md","name":"MAL-2026-12316","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On npm install, the package runs dist/recon.js as a postinstall script that collects the installer's hostname, username, SUDO_USER, home directory, current working directory, all local network interface IPs (including internal addresses), DNS domain, the full list of environment variable names, a filtered subset of env var names matching credential keywords (AWS, GCP, AZURE, NPM, TOKEN, SECRET, KEY, PASS, GITHUB, SSH), and CI indicators, and POSTs the JSON payload over plain HTTP to the hardcoded DigitalOcean address 138.68.108.20:80/cb. The file's header comment labels the collection as 'NON-SENSITIVE telemetry only' and the outgoing User-Agent is 'npm-install-telemetry/1.0', while the package's declared main entry (dist/index.js) is a math-utility stub unrelated to any telemetry function. The scope @cryptosrvc/shift-exchange-root resembles the legitimate @shiftforex/shift-exchange-root, consistent with a dependency-confusion or typosquat lure. Host identity plus internal network topology plus enumerated credential-shaped env var names constitute reconnaissance data suitable for follow-on targeted attacks against the installing environment.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @cryptosrvc/shift-exchange-root (npm)","id":"MAL-2026-12316","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@cryptosrvc/shift-exchange-root","purl":"pkg:npm/%40cryptosrvc/shift-exchange-root","source":"MAL-2026-12316"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12316/"}