The shiftmarkets-sdk npm package version 2.1.0 includes a postinstall hook that runs a script (dist/recon.js) upon installation. This script collects system information such as hostname, username, sudo user, home directory, current working directory, internal IPv4 addresses, DNS domain, CI environment indicators, and environment variable names filtered against a regex targeting credential-related keywords (e.g., AWS, GCP, TOKEN, SECRET, PASS). The collected data is sent via an unencrypted HTTP POST request to a hardcoded IP address (http://138.68.108.20/cb) unrelated to the package's stated purpose. The code's labeling of this activity as 'NON-SENSITIVE telemetry' is misleading, indicating deliberate concealment of reconnaissance activity aimed at harvesting sensitive information.

This malicious behavior can lead to exposure of sensitive environment variables and system information, potentially including credentials and tokens for cloud services, version control, and other critical systems. The unencrypted transmission to an external IP address increases the risk of interception and unauthorized access. This compromises the confidentiality of the affected system's environment and may facilitate further attacks or unauthorized access.

No official patch or remediation is currently documented. Users should avoid installing shiftmarkets-sdk version 2.1.0 and remove it if already installed. Verify dependencies for malicious postinstall scripts and monitor for unexpected network connections to suspicious IP addresses. Patch status is not yet confirmed — check the vendor advisory or official sources for current remediation guidance.