The shift-sdk-v5 package at version 5.0.1 registers a postinstall script that runs dist/recon.js upon npm install. This script gathers detailed host and environment data, including sensitive environment variable names that match patterns related to AWS, GCP, Azure, tokens, secrets, keys, passwords, credentials, GitHub, GitLab, and SSH. The data is exfiltrated via plain HTTP POST to a fixed IP address (138.68.108.20) at the /cb path. The package masquerades as the legitimate @shiftforex/shift-sdk-v4 scoped trading API client but is published unscoped as shift-sdk-v5, likely to deceive users into installing it. The reconnaissance aims to fingerprint the host and CI environment for potential follow-up attacks.

This malicious package can leak sensitive environment and system information from the host where it is installed, including credential-related environment variables and CI context. The exfiltrated data could be used by attackers to identify privileged accounts, internal network details, and cloud credentials, increasing the risk of further compromise. The data is transmitted unencrypted, exposing it to interception. There is no indication of direct code execution beyond the postinstall script, but the information gathered can facilitate targeted attacks.

No official patch or remediation is currently documented for this malicious package. Users should avoid installing shift-sdk-v5 version 5.0.1. Remove the package if already installed and audit systems for potential credential exposure. Use trusted scoped packages and verify package authenticity before installation. Monitor for suspicious network traffic to the IP address 138.68.108.20. Patch status is not yet confirmed — check vendor advisories or npm security advisories for updates.