The @shiftmarkets/no-brainer-sdk npm package version 1.0.18 runs a postinstall lifecycle script 'node dist/recon.js' on every npm install. This script collects detailed host information such as hostname, username, SUDO_USER, home directory, current working directory, network interface addresses (including private IPs), CI indicators, npm lifecycle metadata, and environment variable names. It filters environment variable names against a regex targeting credential-related keywords (e.g., AWS, GCP, TOKEN, SECRET) to identify potential secrets. The collected data is sent as a JSON payload via plain HTTP POST to a hardcoded IPv4 address (http://138.68.108.20:80/cb), which is not affiliated with Shift Markets. The script labels the data as 'NON-SENSITIVE telemetry' but the transmission is unsolicited and exposes sensitive information.

The malicious postinstall script leaks sensitive host reconnaissance data and potential credential indicators to an attacker-controlled server. This exposure can reveal cloud and CI secrets, environment configurations, and network details, increasing the risk of credential compromise and subsequent targeted attacks on the affected system or infrastructure.

No official patch or remediation is currently documented. Users should immediately avoid installing or using version 1.0.18 of @shiftmarkets/no-brainer-sdk. Audit existing installations for the presence of this version and remove or replace the package. Monitor for any suspicious outbound network traffic to the indicated IP address. Check the vendor advisory for updates or official fixes as they become available.