@shiftmarkets/no-brainer-sdk@1.0.18

Analysis

The package @shiftmarkets/no-brainer-sdk@1.0.18 runs a postinstall script (dist/recon.js) that collects system metadata — hostname, username, home directory, working directory, platform, architecture, OS release, Node.js version, network interface IPs, CI/CD environment flags, and the names of all environment variables — then POSTs the data as JSON to 138[.]68[.]108[.]20:80/cb. The beacon specifically enumerates environment variable names matching patterns for cloud provider credentials, API tokens, and CI/CD secrets (AWS, GITHUB, NPM, DOCKER, GITLAB, etc.) to identify high-value build environments. The package claims to be a GraphQL type generator but contains no such functionality.