shift-sdk-v5@5.0.1

Analysis

The postinstall hook in dist/recon.js collects extensive system metadata — hostname, username, sudo_user, home directory, current working directory, platform, architecture, OS release, Node.js version, DNS domain, all network interfaces with internal IPs, CI/CD environment flags, and a filtered list of environment variable names matching secret-related patterns (AWS, GCP, AZURE, NPM, TOKEN, SECRET, KEY, PASS, CRED, GITHUB, GITLAB, SSH). This data is serialized as JSON and POSTed to 138[.]68[.]108[.]20:80/cb. The package's main dist/index.js is a decoy trading API client stub with no real functionality.