The npm package @cryptosrvc/shift-exchange-root contains malicious code that executes a postinstall script collecting detailed environment and system information from the installer. This data includes hostname, username, environment variables with credential-like names, network interface IPs, and CI indicators. The collected information is sent unencrypted to a hardcoded external server. The package name mimics a legitimate package, suggesting a typosquatting or dependency confusion attack vector.