The @cryptosrvc/shift-sdk-v4 npm package version 1.0.77 includes a postinstall script 'node dist/recon.js || true' that executes automatically upon installation. This script enumerates extensive system information such as hostname, username, SUDO_USER, home directory, current working directory, platform details, Node.js version, all IPv4 addresses from network interfaces, DNS domain, CI-provider indicators, and environment variable names. It flags environment variables that match patterns related to AWS, NPM, TOKEN, SECRET, KEY, GITHUB, and SSH as secret-shaped. The collected data is sent as JSON over plain HTTP to a hardcoded IP address (138.68.108.20) hosted on DigitalOcean, which is unrelated to the legitimate SDK publisher. Errors during this process are silently ignored to avoid disrupting the installation. This constitutes a malicious data exfiltration mechanism embedded in the package.

Sensitive host environment information, including user and network details and indicators of secret environment variables, is exfiltrated without user consent. This can lead to privacy breaches and potential further compromise if secrets are exposed. The data is transmitted unencrypted to an unknown third party, increasing the risk of interception and misuse. The malicious behavior is concealed by silent error handling and misleading comments claiming only non-sensitive telemetry is collected.

Users should immediately avoid installing or using version 1.0.77 of @cryptosrvc/shift-sdk-v4. Remove the affected package if installed. Since no official patch or remediation is provided, users should seek alternative trusted packages or versions. Monitor for updates from the package publisher or npm advisories for any official fixes or removals. Consider scanning your environment for any data exfiltration indicators related to this IP or package usage.