The npm package shift-v4-sdk@1.0.5 is a typosquatting malicious package impersonating the legitimate @shiftforex/shift-sdk-v4. Its postinstall script collects extensive system information including hostname, user details, environment variables, and credential-like environment variable names. This data is sent unencrypted over HTTP to a remote server, enabling reconnaissance for potential follow-on attacks.