The @cryptosrvc/no-brainer-sdk npm package version 1.0.18 includes a postinstall script (dist/recon.js) that performs host reconnaissance by gathering system and environment details such as hostname, username, SUDO_USER, home directory, current working directory, network interfaces including internal IPs, DNS domain, and npm lifecycle context. It enumerates environment variables filtering for keys related to cloud providers, authentication tokens, secrets, and credentials. This information is serialized and transmitted in JSON format over plain HTTP to a hardcoded IP address (138.68.108.20:80/cb) with a misleading user-agent and comment claiming the data is 'NON-SENSITIVE telemetry only'. This behavior occurs automatically upon package installation, constituting malicious exfiltration of potentially sensitive data.

The malicious postinstall script can expose sensitive environment variables and system information to an external attacker-controlled server. This may lead to credential leakage, unauthorized access to cloud resources, and compromise of the host environment where the package is installed. The use of plain HTTP for data exfiltration increases the risk of interception. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid installing or using version 1.0.18 of @cryptosrvc/no-brainer-sdk. Review and audit dependencies for malicious postinstall scripts. Consider using package integrity verification and restricting execution of lifecycle scripts in npm.