MAL-2026-12317 Malicious code in @cryptosrvc/shift-sdk-v4 (npm)

package.json declares a postinstall script node dist/recon.js || true that runs automatically on npm install. dist/recon.js collects installer host identity (hostname, username, SUDO_USER, homedir, cwd, platform/arch/release, node version), all internal and external IPv4 addresses from every network interface, the DNS domain via dnsdomainname, CI-provider indicators, and the full list of process.env variable names with a subset matching AWS|NPM|TOKEN|SECRET|KEY|GITHUB|SSH flagged as secret-shaped. The data is POSTed as JSON over plain HTTP to the hardcoded bare IP http://138.68.108.20:80/cb with a 4-second timeout and errors silently swallowed to preserve install success. A source comment frames the behavior as 'NON-SENSITIVE telemetry only', contradicting the actual enumeration of sudo user, network topology, and env-var names. The destination is an unattributed DigitalOcean IP with no relationship to any legitimate SDK publisher.