The npm package @cryptosrvc/shift-sdk-v4 version 1.0.77 contains malicious code executed during installation. A postinstall script runs automatically and collects detailed host environment information, including hostname, user details, network interfaces, DNS domain, CI indicators, and environment variable names with potential secrets. This data is sent unencrypted to an unattributed external IP address. The behavior contradicts the package's claim of collecting only non-sensitive telemetry.