{"answers":{"affected":"1 open source package ship an affected version, including @cryptosrvc/shift-sdk-v4.","exploited":"There is no known exploitation of MAL-2026-12317 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12317 is a malicious package in @cryptosrvc/shift-sdk-v4, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12317 is a malicious package: @cryptosrvc/shift-sdk-v4 (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12317/ (Markdown: https://insights.sbomify.com/MAL-2026-12317/index.md)","id":"MAL-2026-12317","markdown":"https://insights.sbomify.com/MAL-2026-12317/index.md","name":"MAL-2026-12317","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"package.json declares a postinstall script `node dist/recon.js || true` that runs automatically on npm install. dist/recon.js collects installer host identity (hostname, username, SUDO_USER, homedir, cwd, platform/arch/release, node version), all internal and external IPv4 addresses from every network interface, the DNS domain via `dnsdomainname`, CI-provider indicators, and the full list of process.env variable names with a subset matching AWS|NPM|TOKEN|SECRET|KEY|GITHUB|SSH flagged as secret-shaped. The data is POSTed as JSON over plain HTTP to the hardcoded bare IP http://138.68.108.20:80/cb with a 4-second timeout and errors silently swallowed to preserve install success. A source comment frames the behavior as 'NON-SENSITIVE telemetry only', contradicting the actual enumeration of sudo user, network topology, and env-var names. The destination is an unattributed DigitalOcean IP with no relationship to any legitimate SDK publisher.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @cryptosrvc/shift-sdk-v4 (npm)","id":"MAL-2026-12317","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@cryptosrvc/shift-sdk-v4","purl":"pkg:npm/%40cryptosrvc/shift-sdk-v4","source":"MAL-2026-12317"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12317/"}