shift-v4-sdk@1.0.5

Analysis

The package shift-v4-sdk@1.0.5 masquerades as a trading API client but runs a host-reconnaissance script in its postinstall hook. The script collects the victim's hostname, username, home directory, current working directory, OS platform/arch/release, Node.js version, DNS domain, all network interface IPs (including internal addresses), CI/CD environment indicators, and the names of environment variables matching credential-related patterns (AWS, GCP, Azure, NPM, Docker, GitHub, SSH, etc.). This data is serialized as JSON and POSTed to 138[.]68[.]108[.]20:80/cb. The hook uses "|| true" to silently swallow errors so the install never fails. The package contains no real SDK code — only the recon script and a stub entry point.