MAL-2026-12329 Malicious code in @shiftmarkets/shift-sdk-v4 (npm)

The package declares a postinstall script node dist/recon.js that runs automatically on npm install. The script collects installer-side reconnaissance data — hostname, username, SUDO_USER, home directory, current working directory, all local IPv4 addresses (including internal interfaces), DNS domain (via dnsdomainname), CI-provider flags, the full sorted list of process.env variable names, and a filtered subset of environment variable names matching secret/credential regex patterns — and POSTs the JSON payload over plain HTTP to the hardcoded bare IPv4 endpoint http://138.68.108.20:80/cb. An in-file comment frames the beacon as 'NON-SENSITIVE telemetry', but the destination is a bare IP with no publisher affiliation and the payload includes internal network topology and credential-shaped env variable names. The package presents itself as a scoped Shift Forex build compatible with the public shift-sdk-v4 package and ships a minimal API-compatible stub in dist/index.js, consistent with a dependency-confusion lure against consumers who reference shift-sdk-v4 from an internal registry.