The npm package @shiftmarkets/no-brainer-sdk version 1.0.18 contains malicious code that executes a postinstall script collecting extensive host reconnaissance data, including environment variables and potential credential names. This data is sent unencrypted to a hardcoded external IP address unrelated to the vendor, without user consent. The behavior exposes sensitive environment details and credential indicators, potentially enabling follow-up attacks.