The @shiftmarkets/shift-exchange-root npm package in versions 1.9.9, 2.9.9, and 3.9.9 executes a postinstall hook that runs a reconnaissance script (dist/recon.js). This script collects extensive system and environment information, including host identity, internal network details, and environment variable names filtered by credential-related patterns. It exfiltrates this data via a POST request over cleartext HTTP to an external IP address (138.68.108.20) not affiliated with the package publisher. The main package exports trivial math functions unrelated to its name, indicating deceptive behavior. The script's header falsely claims only non-sensitive telemetry is collected, while in reality sensitive host and environment data is gathered and transmitted.

The malicious postinstall script can lead to unauthorized disclosure of sensitive host and environment information, including internal network topology, user identities, and environment variable names that may hint at credentials or secrets. This data exposure can facilitate further targeted attacks or credential harvesting by adversaries controlling the external server. The use of unencrypted HTTP increases the risk of interception. The deceptive nature of the package may cause users to unknowingly install it, leading to compromise of their development or deployment environments.

No official patch or remediation is currently documented. Users should avoid installing the affected versions (=1.9.9, =2.9.9, =3.9.9) of @shiftmarkets/shift-exchange-root. Audit existing installations for the presence of this package and remove it if found. Monitor for network connections to the IP address 138.68.108.20 and block it if possible. Prefer installing packages from trusted sources and verify package integrity before installation. Check the vendor or package repository for updates or advisories regarding this malicious behavior.