The shiftmarkets-sdk npm package version 2.1.0 contains malicious code that executes a postinstall script collecting extensive system and environment information. This script gathers hostname, usernames, network interface details, and environment variable names filtered for credential-like keywords, then sends this data unencrypted to a hardcoded external IP address. The package mislabels this data collection as 'NON-SENSITIVE telemetry,' while it clearly performs reconnaissance for sensitive credentials.