The malicious npm package [email protected] is a typosquat of the legitimate @shiftforex/shift-sdk-v4 package. Upon installation, its postinstall script (dist/recon.js) automatically executes and collects detailed system information such as the installer's hostname, user and sudo user names, home directory, current working directory, DNS domain, network interfaces, IP addresses, and environment variable names. It specifically filters environment variables for names resembling credentials (e.g., AWS, GCP, AZURE, TOKEN, SECRET, KEY, PASS, CRED, GITHUB, GITLAB, SSH). This collected data is sent as a JSON payload over plaintext HTTP to the IP address 138.68.108.20 at the path /cb. Although the code comments claim this is 'non-sensitive telemetry,' the actual behavior constitutes reconnaissance for targeted follow-on attacks.

The package exfiltrates sensitive environment information and system details without user consent, potentially exposing credential-related environment variables and system context to an attacker-controlled server. This reconnaissance data can facilitate further targeted attacks or credential compromise. The use of plaintext HTTP for data exfiltration increases the risk of interception by network adversaries.

Users should avoid installing the shift-v4-sdk package, especially version 1.0.5, as it is a malicious typosquat. Replace any usage of shift-v4-sdk with the legitimate @shiftforex/shift-sdk-v4 package. Since no official patch or fix is available for the malicious package itself, the primary mitigation is to remove the malicious package and audit systems for any sensitive data exposure. Monitor for installations of similarly named typosquatting packages and educate developers to verify package authenticity before installation.