@shiftmarkets/shift-sdk-v4 @1.0.77

Summary

The package declares a postinstall script node dist/recon.js that runs automatically on npm install . The script collects installer-side reconnaissance data — hostname, username, SUDO_USER, home directory, current working directory, all local IPv4 addresses (including internal interfaces), DNS domain (via dnsdomainname ), CI-provider flags, the full sorted list of process.env variable names, and a filtered subset of environment variable names matching secret/credential regex patterns — and POSTs the JSON payload over plain HTTP to the hardcoded bare IPv4 endpoint http://138.68.108.20:80/cb . An in-file comment frames the beacon as 'NON-SENSITIVE telemetry', but the destination is a bare IP with no publisher affiliation and the payload includes internal network topology and credential-shaped env variable names. The package presents itself as a scoped Shift Forex build compatible with the public shift-sdk-v4 package and ships a minimal API-compatible stub in dist/index.js , consistent with a dependency-confusion lure against consumers who reference shift-sdk-v4 from an internal registry.

Source: amazon-inspector (1bff275a2558640accb1a6956b933b71930ece1240bd8c5a0c2e00f74fc2fa82)