@shiftmarkets/shift-exchange-root@3.9.9

Analysis

The package @shiftmarkets/shift-exchange-root@3.9.9 is a trojanized math utility. The postinstall hook runs dist/recon.js, which collects host metadata (hostname, username, home directory, working directory, platform, architecture, OS release, Node.js version), network interface IPs, CI/CD environment flags, and the NAMES of environment variables matching patterns like TOKEN, SECRET, KEY, AWS, NPM, GITHUB, GITLAB, SSH, DOCKER, KUBE, VAULT, CRED. This data is serialized as JSON and POSTed to hxxp://138[.]68[.]108[.]20:80/cb. The hook uses '|| true' to silently swallow errors and never break the install. The legitimate dist/index.js exports math functions (sum, multiply, divide, subtract, percent) to disguise the package as a normal dependency.