The npm package @cryptosrvc/no-brainer-sdk version 1.0.18 contains malicious code that executes during the postinstall lifecycle event. This code collects detailed host information including hostname, username, sudo user, home directory, current working directory, network interfaces, DNS domain, and environment variables related to credentials and cloud services. The collected data is sent unencrypted via HTTP to a hardcoded external IP address, potentially exposing sensitive environment details. No official patch or remediation guidance is provided.