MalwarePublished 5 Aug 2026

@shiftmarkets/shift-exchange-root (npm) · Malicious Code

Affects @shiftmarkets/shift-exchange-rootSource GCVE Database

Malicious package : remove @shiftmarkets/shift-exchange-root and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 15:42 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12509

What to do

Remove @shiftmarkets/shift-exchange-root from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@shiftmarkets/shift-exchange-root	Affected =3.9.9 =2.9.9 =1.9.9	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @shiftmarkets/shift-exchange-root versions 1.9.9, 2.9.9, and 3.9.9 contains malicious code in its postinstall script. This script collects detailed host information including hostname, username, sudo user, home directory, internal IP addresses, DNS domain, environment variable names filtered by credential-related keywords, and CI indicators. It then sends this data over unencrypted HTTP to an unaffiliated external IP address. The package's main functionality does not align with its name, and the script's comment misleadingly claims only non-sensitive telemetry is collected, contradicting the actual data gathered.

Impact

The malicious postinstall script can lead to unauthorized disclosure of sensitive host and environment information, including internal network topology, user identities, and environment variable names that may hint at credentials or secrets. This data exposure can facilitate further targeted attacks or credential harvesting by adversaries controlling the external server. The use of unencrypted HTTP increases the risk of interception. The deceptive nature of the package may cause users to unknowingly install it, leading to compromise of their development or deployment environments.

Defensive guidance

Users should avoid installing the affected versions (=1.9.9, =2.9.9, =3.9.9) of @shiftmarkets/shift-exchange-root. Audit existing installations for the presence of this package and remove it if found. Monitor for network connections to the IP address 138.68.108.20 and block it if possible. Prefer installing packages from trusted sources and verify package integrity before installation. Check the vendor or package repository for updates or advisories regarding this malicious behavior.

Summary

The @shiftmarkets/shift-exchange-root npm package in versions 1.9.9, 2.9.9, and 3.9.9 executes a postinstall hook that runs a reconnaissance script (dist/recon.js). This script collects extensive system and environment information, including host identity, internal network details, and environment variable names filtered by credential-related patterns. It exfiltrates this data via a POST request over cleartext HTTP to an external IP address (138.68.108.20) not affiliated with the package publisher. The main package exports trivial math functions unrelated to its name, indicating deceptive behavior. The script's header falsely claims only non-sensitive telemetry is collected, while in reality sensitive host and environment data is gathered and transmitted.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 15:42 UTC

Technical details

References

Community reviews