The npm package @shiftmarkets/shift-exchange-root versions 1.9.9, 2.9.9, and 3.9.9 contains malicious code in its postinstall script. This script collects detailed host information including hostname, username, sudo user, home directory, internal IP addresses, DNS domain, environment variable names filtered by credential-related keywords, and CI indicators. It then sends this data over unencrypted HTTP to an unaffiliated external IP address. The package's main functionality does not align with its name, and the script's comment misleadingly claims only non-sensitive telemetry is collected, contradicting the actual data gathered.